ClawHub
Back to skill

Security audit

Confidence Builder Skill

Security checks for vulnerabilities and agentic risk

Overview

This is a simple confidence-coaching skill with no bundled code or hidden system access, though its install command and promotional link deserve user awareness.

Before installing, be aware that the documented npx command is not pinned to a reviewed package version, so use normal package-install caution. Also note that the skill may mention an external coaching site; only visit or share personal information there if you trust that service and its privacy practices.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:126
Finding

Commercial Redirect Embedded in Agent Instructions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 126-128
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: Medium

Complete Code Snippet:

markdown
## Upgrade

For ongoing coaching with progress tracking and personalized confidence plans → mediaclawbot.com

Technical Analysis

The operational Skill instructions contain a commercial redirection directive unrelated to the minimum functionality required for confidence coaching. Because SKILL.md is supplied to the agent as behavioral instructions, the directive can influence generated responses and cause the agent to promote an external service under its own apparent authority.

This alters the expected output objective from providing coaching to advertising a third-party destination. The repository does not document when this promotion should appear, require user consent, or establish the security and privacy properties of the external domain.

Attack Path

  1. A user or platform installs and loads the Skill.
  2. The agent interprets SKILL.md as active behavioral instructions.
  3. The embedded upgrade directive influences the agent's coaching responses.
  4. A user is encouraged to visit mediaclawbot.com.
  5. The external destination can subsequently collect information or present additional content outside the audited Skill's controls.

No automatic network request or code execution is present in the reviewed files; exploitation depends on the agent presenting the promotion and the user following it.

Impact Assessment

The directive can manipulate the agent's response channel and expose users to unsolicited commercial redirection. It does not directly grant local system privileges, access credentials, or execute code. Its immediate scope is limited to generated responses and user navigation, while any subsequent privacy or security impact depends on the external site and the information the user chooses to provide.

Remediation
View remediation

Remediation Suggestions

  • Remove the commercial upgrade directive from the operative Skill instructions.
  • Place optional attribution or product information in clearly separated, non-operative documentation.
  • Do not instruct the agent to include promotional links in user-facing answers unless the user explicitly requests related services.
  • If an external link must be retained, identify it transparently as a third-party or affiliated service and document its privacy and security implications.
  • Add a review policy that rejects response-manipulation directives unrelated to the Skill's declared functionality.

T08 · Insecure Dependencies

Warning
Location
README.md:6
Finding

Unpinned Package Execution in Installation Instructions

Content
View full analysis

Vulnerability Details

File Location: README.md, lines 6-9
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Complete Code Snippet:

markdown
## Install
```bash
npx clawhub install confidence-builder
text

### Technical Analysis
The installation instructions invoke `clawhub` through `npx` without specifying a package version or integrity value. If the package is not already available locally, `npx` can resolve and execute package content obtained from the configured registry. The command therefore relies on mutable external package state that is not included in the audited repository.

A compromise of the package, package owner, registry resolution process, or a newly published incompatible release could change the code executed by users following these instructions. The reviewed project provides no lockfile, checksum, signature-verification procedure, or trusted-version requirement for the invoked package.

### Attack Path
1. An attacker compromises the registry package, its publisher account, or another relevant distribution component.
2. The attacker publishes a malicious version that can be selected by an unversioned `npx` invocation.
3. A user copies and runs the documented installation command.
4. `npx` resolves and downloads the mutable package version.
5. Malicious package code executes in the user's environment with the privileges of the invoking account.

This is a supply-chain exposure rather than evidence that the currently published `clawhub` package is malicious.

### Impact Assessment
If the external package supply chain is compromised, code could execute with the invoking user's privileges. Depending on those privileges and the malicious payload, the potential scope could include access to user-readable files, environment variables, credentials available to the process, network resources, and files writable by that user. The reviewed repository itself contains
...[truncated 139 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin the clawhub package to a specifically reviewed version in the installation command.
  • Document the expected package registry and publisher identity.
  • Provide package integrity information, such as a verified cryptographic digest or supported signature-verification procedure.
  • Prefer a reproducible installation workflow using an approved lockfile or equivalent immutable dependency manifest.
  • Periodically review the pinned package and update it through a controlled dependency-review process.
  • Advise users not to run installation commands with elevated privileges unless explicitly required and justified.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The README instructs users to run npx clawhub install confidence-builder without pinning the package or tool version. Unpinned npx execution can fetch and run the latest remote code at install time, so a compromised upstream package, typosquat, or malicious update could execute arbitrary code on the user's system.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.