Dating App Coach Skill

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:49 AM UTC
• Version: 1.0.1

Overview

This is a dating profile and messaging coaching prompt with no hidden code; the main caution is an unpinned install command.

Reasonable to install as a prompt-only dating coach, but use a trusted ClawHub installation path and prefer pinned or verified installer versions when available. Also avoid sharing sensitive personal conversations or contact details unless you are comfortable with the agent processing them.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:6

Finding

Unpinned npm Package Execution in Installation Instructions

Content

View full analysis

Vulnerability Details

File Location: README.md, line 6
Vulnerability Type: Supply-chain exposure through unpinned remote package execution
Risk Level: Medium

Vulnerable Code:

bash

npx clawhub install dating-app-coach

Technical Analysis

The documented installation command invokes clawhub through npx without specifying a package version or integrity value. If the package is not already available locally, npx may retrieve and execute the currently published package from the configured npm registry.

Because the dependency is mutable and its implementation is not included in this repository, the code executed by this command can differ from the code that was originally reviewed. This creates a supply-chain trust boundary: compromise of the package, its publisher account, or the configured registry could cause the installation command to execute attacker-controlled code.

The repository does not provide a lockfile, expected package version, integrity hash, registry constraint, or other mechanism for authenticating the package executed by this command.

Attack Path

1. An attacker compromises the clawhub npm package, its publisher account, or an npm registry used by the victim.
2. The attacker publishes a malicious version under the expected package name.
3. A user follows the installation instructions and runs npx clawhub install dating-app-coach.
4. npx resolves and downloads the mutable package version from the configured registry.
5. The downloaded package executes with the privileges of the user running the command.
6. Malicious package code can access resources available to that user, subject to operating-system and environment restrictions.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the installing user. Depending on that user's permissions and environment, the malicious package could read or modify user-ac ...[truncated 374 chars]

Remediation

View remediation

Remediation Suggestions

• Pin clawhub to a specific reviewed version rather than resolving the latest release implicitly.
• Verify the selected release's provenance and integrity before documenting it for installation.
• Use a lockfile or an equivalent reproducible dependency mechanism where supported.
• Document the trusted npm registry and avoid allowing installation from arbitrary registry configurations.
• Prefer installing the pinned package without executing it immediately, reviewing its contents, and then invoking the verified local binary.
• In automated environments, run installation with minimal privileges and without unnecessary credentials or sensitive environment variables.
• Consider publishing checksums or signed provenance information for the expected installer artifact.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The README instructs users to run npx clawhub install dating-app-coach without pinning a specific package version, which can cause execution of whatever version is current at install time. If the upstream package, dependency chain, or distribution channel is compromised, users may unknowingly execute malicious code during installation.

Content

No source excerpt is available for this finding.