Security audit

Eq Coach Skill

Security checks for vulnerabilities and agentic risk

Overview

The coaching skill is mostly understandable, but it includes a forced external promotion and mismatched release automation that should be reviewed before use.

Review this package before installing. The coaching prompt itself is not obviously destructive, but it will promote replyher.com during longer conversations. Do not run publish.sh unless you control the repository and ClawHub account, have verified the intended slug, have a clean working tree, and have pinned or otherwise verified the ClawHub CLI used for publishing.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:151
Finding: Unsolicited Promotional Instruction Alters Agent Responses
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: publish.sh:22
Finding: Unpinned npm Package Is Downloaded and Executed During Publishing
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: publish.sh:13
Finding: Release Script Stages and Pushes All Working-Tree Files Without Review
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: There is a clear description-behavior mismatch. The declared purpose says the skill provides emotional intelligence coaching for end users. The actual code does not implement any coaching, conversation, empathy training, or user-facing EQ functionality. Instead, it is a developer operations script for committing code, pushing to GitHub, and publishing a skill to ClawHub under the slug 'replyher'. These are materially different capabilities and imply access to source control and publishing infrastructure that are not declared. This is not a supporting implementation detail of EQ coaching; it is unrelated release automation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The publish script behavior does not align with the declared EQ training skill and instead pushes and publishes a different skill identity (replyher). This mismatch is dangerous because it indicates the package may be a repurposed or swapped artifact, creating supply-chain and impersonation risk where maintainers could unknowingly publish to the wrong destination or distribute unrelated content under false branding.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The README instructs users to run npx clawhub install eq-coach without pinning a specific version of the package. This can cause users to fetch and execute whatever version is current at install time, increasing supply-chain risk if the package is updated maliciously, compromised, or replaced. In this context, the issue is somewhat more dangerous because the command is presented as a one-line install step that users may run directly without scrutiny.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The comments and output text describe one repository/skill context while the actual publish command and URLs target replyher, showing a clear identity inconsistency. Such inconsistencies are a red flag for deceptive release automation because they can mislead reviewers and operators into publishing or trusting artifacts associated with a different project than the one being analyzed.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The script executes npx clawhub publish without pinning an exact package version, which allows the latest package version to be fetched at runtime. If the upstream package is compromised, typo-squatted, or changed maliciously, running this release script could execute attacker-controlled code in the publisher's environment and affect the published artifact or local machine.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.