Security audit

Skill Finder (Find ClawHub skills + Search Skills.sh)

Security checks for vulnerabilities and agentic risk

Overview

This skill has a useful purpose, but it needs review because setup can persistently change agent routing and its commands run unpinned external CLIs.

Review this before installing. Decline or manually edit the AGENTS.md steering unless you explicitly want this skill loaded for future capability-related requests. Prefer pinned, reviewed versions of the clawhub and skills CLIs, inspect candidate skills before installation, and avoid sending sensitive task details as registry search queries.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Warning

Location: setup.md:60
Finding: Persistent Modification of Workspace Agent Routing
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:149
Finding: Execution of Unpinned Third-Party Packages Through npx
Content: View full analysis
npx clawhub install npx clawhub list # Skills.sh ecosystem npx skills find [query] npx skills add npx skills list npx skills check npx skills update # Example install string returned by `npx skills find` npx skills add vercel-labs/agent-skills@vercel-react-best-practices ``` ### Technical Analysis The Skill invokes `clawhub` and `skills` through `npx` without specifying reviewed package versions or integrity constraints. When a package is not already available locally, `npx` may download and execute its current registry release. Consequently, even nominally read-only operations such as search, inspect, or list can execute externally supplied package code. The effective dependency payload can change after this Skill has been audited. A compromised package maintainer account, malicious newly published release, package-name takeover, or registry compromise could therefore cause attacker-controlled code to execute when any documented command is invoked. The `npx skills add ` workflow also installs Skill content identified by a mutable repository reference rather than a verified immutable revision. Although the project requires explicit consent before installing a Skill, it does not require consent before `npx` retrieves or executes the CLI package used to perform searches. The installation-consent boundary therefore does not fully mitigate the CLI supply-chain risk. ### Attack Path 1. An attacker compromises the registry package, maintainer account, release pipeline, or upstream repository associated with `clawhub`, `skills`, or a recommended Skil ...[truncated 1111 chars]
Remediation: View remediation
` and `npx skills@`. 2. Prefer dependencies installed from a lockfile with verified integrity hashes instead of downloading executable packages dynamically for every invocation. 3. Require explicit user consent before the first network retrieval and execution of an `npx` package, not only before installing a resulting Skill. 4. Verify package ownership, registry provenance, signatures, and checksums before execution. 5. Pin installed Skills to immutable commit hashes, release tags with verified signatures, or content digests where the ecosystem supports them. 6. Inspect the complete candidate package or repository at the exact revision that will be installed. 7. Run search and inspection tools with least privilege in a sandbox that restricts filesystem access, environment variables, subprocess execution, and network destinations. 8. Disable unnecessary package lifecycle scripts where supported and avoid commands that silently update installed content. 9. Record the reviewed CLI version, candidate revision, source repository, and integrity value with each recommendation. ]]>

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (67)

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The setup promises that no data is written outside ~/skill-finder/, but later instructs modifying AGENTS.md outside that directory. This is dangerous because it misrepresents the skill's write scope and can lead users or higher-level agents to grant trust under false assumptions, enabling persistent behavioral changes beyond the declared boundary.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The document explicitly instructs adding routing lines to AGENTS.md, which exceeds the stated local-storage boundary and introduces persistence in a global agent-control file. Modifying routing/steering configuration can have long-lived effects on future agent behavior, potentially forcing this skill to load automatically and broadening its influence beyond the immediate task.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The top-level description says to use the skill whenever a user asks how to do something, improve a workflow, or install a capability. That scope is so broad it can trigger on ordinary requests and cause unnecessary search, external queries, or installation-oriented behavior in contexts where direct assistance would be safer and more appropriate.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The listed activation signals include generic phrases like 'How do I do X?' and 'Can you do this better?', which are common in routine conversations. Overbroad triggers can cause unintended invocation of a skill that sends queries off-machine and steers toward third-party code installation without sufficiently clear user intent.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The skill instructs use of npx clawhub without pinning a package version, which means execution depends on whatever version is currently resolved from the registry at runtime. That creates a supply-chain and reproducibility risk: a compromised, maliciously updated, or breaking new release could be fetched and executed implicitly.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The unpinned npx skills command executes whichever package version is resolved at runtime, exposing users to supply-chain tampering or unsafe upstream changes. Because this skill is specifically about discovery and installation, it normalizes repeated execution of remote CLI code, increasing exposure.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: This line again directs use of unversioned npx clawhub, allowing silent drift to newly published code. Attackers who compromise the package or publish a harmful update could gain code execution when users follow the skill instructions.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: This line again directs use of unversioned npx clawhub, allowing silent drift to newly published code. Attackers who compromise the package or publish a harmful update could gain code execution when users follow the skill instructions.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The search examples rely on unpinned npx clawhub, which still requires fetching/executing remote package code. Even though the operation is 'search', compromise of the CLI would affect the local machine before any skill recommendation is made.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The search examples rely on unpinned npx clawhub, which still requires fetching/executing remote package code. Even though the operation is 'search', compromise of the CLI would affect the local machine before any skill recommendation is made.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: This line continues the pattern of unpinned runtime package execution via npx clawhub. Because the skill may be activated often, repeated use compounds the chance of pulling an unexpected or malicious release.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: This line continues the pattern of unpinned runtime package execution via npx clawhub. Because the skill may be activated often, repeated use compounds the chance of pulling an unexpected or malicious release.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The install command uses unpinned npx clawhub, so two trust boundaries are crossed at once: first the CLI package itself, then the selected skill package. A compromise in the CLI distribution path could subvert even otherwise safe install decisions.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The install command uses unpinned npx clawhub, so two trust boundaries are crossed at once: first the CLI package itself, then the selected skill package. A compromise in the CLI distribution path could subvert even otherwise safe install decisions.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The command reference for npx clawhub search is unversioned, preserving the same supply-chain execution risk throughout the skill. Reference sections are especially important because users often copy-paste them directly.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: npx clawhub inspect <slug> is also unpinned, so a user performing a supposedly safer inspection step still executes potentially unreviewed latest code. That weakens the skill's stated security posture around reviewing candidates before installation.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The install command again uses unpinned npx clawhub, which could allow malicious or unexpected behavior before or during installation. Since installation changes the environment, the consequence of a compromised CLI is more severe than a purely informational command.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: Listing installed skills with unpinned npx clawhub list still carries runtime package execution risk from the registry. The operation being read-only in intent does not reduce the underlying trust issue of executing latest remote code.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The npx skills find reference is unversioned, creating the same supply-chain exposure as other npx uses. Because this ecosystem is described as broad and open, careful control of the CLI version is especially important.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: npx skills add without a pinned CLI version can execute unreviewed latest CLI code while also installing third-party skill content. That creates layered supply-chain risk and undermines the otherwise cautious consent language in the document.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The unpinned npx skills list command still relies on runtime resolution of package code. Even non-install actions should not normalize executing an unspecified latest package in a security-sensitive workflow.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: npx skills check is another unversioned remote CLI execution point. Security-checking commands are particularly sensitive because users may trust them more, but the tool performing the check is itself not pinned.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The update command references unpinned npx skills, which could pull different tool behavior over time and execute compromised code. Update workflows should be especially controlled, not left to latest-version resolution.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The example install string from skills find still shows unpinned npx skills add, encouraging users to copy-paste an unsafe invocation pattern. Example commands strongly influence actual operator behavior, so this is a practical rather than theoretical risk.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: This line continues the copy-pasteable unpinned npx skills add pattern. In a skill whose purpose is to help install more code, unpinned bootstrap tooling materially increases attack surface.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.