ClawHub
Back to skill

Security audit

BNBOT Mascot

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its image-generation purpose, but it needs review because it reads a hard-coded local API-key file and imports executable code from a neighboring skill outside its package.

Install only if you are comfortable with the skill using a Google AI API key, uploading prompts and reference images to Gemini, and relying on local developer-style paths. Before use, remove the hard-coded .env fallback, vendor or pin the chromakey dependency instead of importing a neighboring skill, and prefer a pinned installer command.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Error
Location
scripts/generate_mascot.py:29
Finding

Untrusted and Unpinned Sibling Skill Module Execution

Content
View full analysis

Vulnerability Details

File Location: scripts/generate_mascot.py, lines 29–30
Vulnerability Type: Unverified external Python dependency loaded through path manipulation
Risk Level: High

python
# Import chromakey from sibling skill
sys.path.insert(0, str(Path(__file__).parent.parent.parent / "transparent-image-gen" / "scripts"))
from chromakey_despill import chromakey_with_despill

Technical Analysis

The script prepends a directory belonging to a separate sibling skill to sys.path and then imports chromakey_despill from that location. Python executes module-level code immediately during an import.

The imported module is not included in this project, pinned to a reviewed version, or subject to an integrity check. Consequently, this project's behavior depends on mutable code outside its audited package boundary. Prepending the directory also gives that location priority during module resolution.

This is a supply-chain and local module-substitution weakness. An attacker who can publish, install, create, or replace the expected sibling skill can introduce arbitrary Python statements into chromakey_despill.py. Those statements execute as soon as generate_mascot.py is loaded, before image generation begins.

Attack Path

  1. The attacker gains control over, compromises, or supplies the sibling transparent-image-gen skill.
  2. The attacker places malicious code in: transparent-image-gen/scripts/chromakey_despill.py.
  3. A user or agent invokes the mascot generator or imports generate_mascot.py.
  4. The script inserts the sibling directory at the beginning of sys.path.
  5. Python resolves and imports the attacker-controlled chromakey_despill module.
  6. The malicious module's top-level code executes with the same permissions and environment as the agent process.

Impact Assessment

Successful exploitation provides arbitrary Python code execution under the account running the ...[truncated 479 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the runtime sys.path modification.
  • Vendor the required chromakey implementation into this project and include it in the normal review process, or publish it as a properly packaged dependency.
  • Pin the dependency to an exact reviewed version and verify its cryptographic hash during installation.
  • Use an isolated virtual environment with a locked dependency manifest.
  • If a sibling skill must be supported, resolve it through a trusted registry and verify its path, ownership, version, and integrity before importing it.
  • Avoid importing mutable code from user-writable shared directories.
  • Run the skill with least privilege and provide only the credentials and filesystem access needed for image generation.

T08 · Insecure Dependencies

Warning
Location
README.md:14
Finding

Unpinned Package Execution in Installation Instructions

Content
View full analysis

Vulnerability Details

File Location: README.md, line 14
Vulnerability Type: Unpinned package execution through npx
Risk Level: Medium

bash
npx clawhub install bnbot-mascot

Technical Analysis

The documented installation command invokes clawhub through npx without specifying an exact package version or integrity value. If the package is not already available in a trusted local cache, npx may retrieve and execute the version currently resolved by the configured npm registry.

The effective installer can therefore change after this skill has been reviewed. A compromised package release, registry account, registry response, or unexpectedly incompatible future release could execute code during installation.

Attack Path

  1. An attacker compromises the package publisher, the relevant registry supply chain, or a future package release.
  2. A malicious or altered version becomes the version resolved for the unpinned clawhub package.
  3. A user follows the README and runs npx clawhub install bnbot-mascot.
  4. npx retrieves the resolved package when it is not already installed locally.
  5. The downloaded package is executed with the user's current permissions.
  6. Malicious package code can act before or during installation of the skill.

Impact Assessment

Exploitation can result in arbitrary code execution with the permissions of the user running the installation command. This may expose user-readable files, development credentials, npm configuration, agent data, and environment variables. It may also permit modification of user-owned files or installation artifacts.

This finding does not demonstrate that the current clawhub package is malicious. The risk arises because the instructions do not bind execution to a specific reviewed release or verified artifact.

Remediation
View remediation

Remediation Suggestions

  • Pin clawhub to an exact, reviewed version rather than relying on the registry's current resolution.
  • Use an explicit command such as:
    bash
    npx --package=clawhub@<reviewed-exact-version> -- clawhub install bnbot-mascot
  • Publish and verify package integrity hashes where the installation workflow supports them.
  • Use a lockfile or an organization-controlled package mirror containing approved artifacts.
  • Document the expected package publisher, version, and checksum so users can verify provenance.
  • Periodically review pinned releases before updating the documented version.
  • Run installation with a non-privileged account and avoid using sudo.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
Findings (9)

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

The explicit access to /Users/jacklee/Projects/BNBOT/.env is credential access behavior: the skill attempts to read a local secret file and extract GOOGLE_AI_API_KEY from it. In an agent skill, this is more dangerous because mascot generation does not require arbitrary host file access, so the behavior expands the skill's privilege footprint and could expose local developer secrets if the environment is compromised or logs/errors leak details.

Content

Scanner excerpt · scripts/generate_mascot.py (reported line 93)May include surrounding context.

python
key = os.environ.get("GOOGLE_AI_API_KEY")
    if key:
        return key
    env_path = Path("/Users/jacklee/Projects/BNBOT/.env")
    if env_path.exists():
        for line in env_path.read_text().splitlines():
            if line.startswith("GOOGLE_AI_API_KEY="):

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The README instructs users to run npx clawhub install bnbot-mascot without pinning a specific version, which can cause consumers to execute whatever package version is current at install time. If the referenced package or a dependency is compromised, republished, or behavior changes unexpectedly, users may run unreviewed code during installation or setup.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding

The skill references sensitive capabilities such as reading an API key from a local .env file and accessing local reference images, but it does not declare any explicit tool scope or permission boundaries. In a skill system, undocumented file/env access increases the risk of overbroad capability use, accidental secret exposure, or future prompt/path manipulation through downstream scripts.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: bnbot-mascot
description: Generate BNBOT lobster-bot mascot images in consistent style using reference images. Use when the user asks to generate mascot illustrations, character poses, tweet images, stickers, or any BNBOT branded artwork. Triggers on requests like "generate a mascot image", "make a BNBOT illustration", "create a tweet image with the lobster", "generate mascot sticker".
version: 0.1.0
homepage: https://github.com/jackleeio/bnbot-mascot-skill
metadata:

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The script modifies sys.path to import executable code from a sibling skill, which weakens module trust boundaries and allows behavior to be influenced by external filesystem contents. If that sibling path is modified or replaced, this skill will execute attacker-controlled Python during import, creating a code-execution and supply-chain style risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The code falls back to reading a Google API key from a hard-coded absolute path outside the skill directory. This creates an unexpected dependency on host-local secrets and can cause the skill to access credentials unrelated to the current execution context, increasing the chance of unauthorized secret use or accidental credential exposure on a developer machine.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Reading credentials from a hard-coded local .env path without disclosure is insecure secret handling because it silently consumes sensitive host credentials. In multi-user or agent-executed environments, this can lead to unexpected secret access and makes auditing or consent around credential use much harder.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The function sends the reference image and action prompt to Google's Gemini API, which is a network operation that transmits user- or system-provided data externally. The docstring describes image generation but does not explicitly warn that local image content and prompt text are uploaded to a third-party service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The action examples include Chinese text translations alongside English prompts, but the document does not state that the skill is intended specifically for Chinese-speaking users or provide an opt-in language choice. This can conflict with language/locale policy expectations when a skill implicitly assumes or enforces a language preference.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:29