Skill Starter Pack

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:09 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed starter-pack installer, but it can bulk-install many agent-changing skills through unpinned tooling with limited user control.

Review the listed skills individually before installing, especially the memory, self-improvement, find-skills, GitHub, browser automation, and proactive-agent entries. Prefer a trusted, version-checked clawhub CLI over npx fallback, avoid passing extra skill names, and only restart/activate the new skills after confirming their publishers, permissions, and setup requirements.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/install_pack.py:50

Finding

Unpinned CLI and Skill Dependencies Are Installed Without Integrity Verification

Content

View full analysis

Remediation

View remediation

clawhub`. - Prefer a preinstalled, managed CLI and use `npx --no-install` where compatible to prevent implicit downloads. - Verify the detected global executable's version against an approved version range. 2. **Pin installed skills** - Define an immutable version for every curated skill. - If the CLI supports it, install using identifiers such as `skill-name@version`. - Maintain reviewed version metadata in the pack definition rather than resolving the latest release automatically. 3. **Verify dependency integrity and identity** - Validate cryptographic hashes or signatures before activating downloaded content. - Check the expected publisher, package source, and registry for every curated skill. - Fail closed when verification metadata is missing or does not match. 4. **Restrict arbitrary extra skills** - Reject extra skill names by default or validate them against a configurable allowlist. - If arbitrary extras are required, display the resolved publisher, source, version, and permissions, then obtain explicit user confirmation before installation. - Validate identifiers against the exact syntax accepted by the registry to reduce package-name deception. 5. **Separate download, review, and activation** - Download dependencies into a staging directory. - Inspect their manifests, scripts, requested capabilities, and hashes before installation. - Require approval before moving staged content into the active OpenClaw skill directory. 6. **Document the trust boundary** - Clearly warn users that installed skills are third-party content that may contain executable code or agent instructions. - Do not instruct users to restart and activate newly installed content until its source and integrity have been verified. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (10)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill instructs the agent to execute a shell command (python <skill-dir>/scripts/install_pack.py <pack-name>) but does not declare any permissions or allowed-tools scope. This creates an authorization gap where a broadly triggered skill can cause command execution without explicit tool scoping, increasing the chance of unintended or unsafe installs.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger description is very broad, covering generic phrases like setup/help/recommendation intents in multiple languages. In a skill that performs package installation and shell execution, broad invocation raises the risk that the agent auto-selects this skill in contexts where the user did not clearly consent to installing software.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The skill relies on npx clawhub, which fetches and runs a package without pinning a specific version. If the upstream package changes, is compromised, or resolves unexpectedly, the installer could execute unreviewed code on the user's system during skill setup.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The find-skills description includes broad trigger phrases like 'how do I do X' and 'find a skill for X', which can overlap with ordinary user requests. This can cause unintended activation of a meta-skill that searches for and installs additional capabilities, potentially expanding the agent's permissions or behavior without the user explicitly asking to install software. In this pack, that is more dangerous because the overall skill is explicitly about bulk setup and recommending more skills.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The quick-note trigger includes a very generic phrase, 'note this', which may appear in normal conversation and unintentionally invoke the skill. Accidental capture can lead to unreviewed storage of sensitive or irrelevant information, especially in a pack aimed at new users who may not understand when a persistence feature is being activated. The impact is lower than auto-install behavior, but still creates privacy and consent concerns.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The documentation recommends running npx clawhub, which fetches and executes the latest package version at runtime without pinning. That creates a supply-chain risk: a compromised upstream release or dependency could cause users to execute unexpected code during install or use. In a skill whose purpose is one-click installation of many other skills, this risk is amplified because users are being guided toward convenience over review.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

Falling back to npx clawhub without pinning a specific version means the script may execute whatever version of clawhub resolves at runtime. That creates a supply-chain risk: a compromised, malicious, or breaking upstream release could be executed automatically during installation.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/install_pack.py (reported line 70)May include surrounding context.

python

"""Install a single skill. Returns (name, success, message)."""
    cmd = cmd_base + ["install", skill_name]
    try:
        result = subprocess.run(
            cmd,
            capture_output=True,
            text=True,

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script accepts arbitrary extra skill names from the command line and installs them, which expands behavior beyond the advertised curated starter packs. In a security-sensitive agent ecosystem, this can be abused to socially engineer users into installing unreviewed or malicious skills under the cover of a trusted 'starter pack' workflow.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

Using npx as a fallback broadens the trust boundary from a known local clawhub binary to dynamic package resolution and execution. In the context of a 'one-click install' skill, that makes the workflow more dangerous because users may not realize it can fetch and run package-manager mediated code rather than just invoke a preinstalled tool.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.