ClawHub
Back to skill

Security audit

dgent

Security checks for vulnerabilities and agentic risk

Overview

The skill appears purpose-aligned, but it installs an unpinned npm tool and describes automatic git-hook cleanup that can rewrite files or commit messages without clear controls.

Review this before installing in important repositories. Use the JSON/check modes first, pin or verify the npm package where possible, review diffs after any --fix run, and confirm whether git hooks will rewrite commit messages before enabling it in a signed or policy-controlled workflow.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:6
Finding

Unpinned External npm Dependency Creates a Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 6
Vulnerability Type: Unpinned third-party package installation
Risk Level: Medium

Vulnerable Code

yaml
metadata: { "openclaw": { "requires": { "bins": ["dgent"] }, "install": [{ "kind": "node", "package": "@itscojac/dgent", "bins": ["dgent"], "label": "Install dgent (npm)" }], "emoji": "broom", "homepage": "https://github.com/ItsCodejac/dgent", "os": ["darwin", "linux"] } }

Technical Analysis

The Skill delegates its file-scanning and modification behavior to the external npm package @itscojac/dgent, but the installation metadata does not specify an exact version or an integrity digest. Consequently, installation may resolve to a package release that differs from the version reviewed when this Skill was published.

npm package installation can also execute package lifecycle scripts unless they are explicitly disabled. If the package, its publication account, or one of its transitive dependencies is compromised, attacker-controlled code could execute with the privileges of the user installing the Skill. The declared GitHub homepage does not cryptographically bind the installed registry artifact to a reviewed source revision.

This finding identifies an unsafe dependency-resolution practice. The available project content does not establish that the current package is malicious.

Attack Path

  1. An attacker compromises the npm package publication account, a transitive dependency, or the package’s release process.
  2. The attacker publishes a modified release under the expected @itscojac/dgent package name.
  3. A user installs the Skill or satisfies its declared binary requirement.
  4. Because no exact version or integrity value is specified, the installer resolves the attacker-controlled release.
  5. Malicious lifecycle code may execute during installation, or malicious behavior may execute when the documented dgent commands are invoked.

...[truncated 940 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin @itscojac/dgent to an exact, audited version rather than allowing implicit latest-version resolution.
  2. Use a lockfile and verify the package with a trusted integrity hash or equivalent cryptographic provenance control.
  3. Confirm that the published npm artifact corresponds to a reviewed source commit and release tag.
  4. Review the package’s direct and transitive dependencies before approving upgrades.
  5. Disable npm lifecycle scripts during installation where the package does not strictly require them, such as by using an installation mode equivalent to --ignore-scripts.
  6. Execute the tool with least privilege in an isolated environment that exposes only the repository files necessary for the scan.
  7. Require explicit user review before applying --fix output or accepting changes to Git hooks and configuration.
  8. Establish a controlled update process in which new dependency versions are reviewed, tested, and approved before the pinned version is changed.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill explicitly states that it runs as git hooks automatically, which can modify user-controlled artifacts during normal development flow without a prominent warning or consent step. Even if the modifications are intended as cleanup, automatic alteration of files or commit metadata can surprise users, hide meaningful content changes, or interfere with established review and signing workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documented --fix mode rewrites files in place, but the skill does not present a clear caution about destructive modification or the need to review changes first. In-place rewriting can lead to unintended loss of content, semantic breakage, or corruption of work if users invoke it assuming it is only a diagnostic check.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The workflow says hooks will clean trailers and emoji automatically during commit, implying commit message content may be rewritten without an explicit warning at the point of use. Silent commit-message mutation can alter user intent, produce inaccurate history, and conflict with policies requiring exact commit text, such as conventional commits or signed audit trails.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.