ClawHub
Back to skill

Security audit

AgentPin

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent AgentPin development guide with expected cryptographic identity examples and no hidden or destructive behavior in the inspected artifacts.

Installers should treat the npm and PyPI SDKs as external code: verify the package identity, pin versions for production or sensitive projects, and keep private keys and issued credentials in appropriately protected project locations.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:102
Finding

Unpinned npm Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 102
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

bash
npm install agentpin

Technical Analysis

The guide instructs users or AI agents to install the agentpin package from the npm registry without specifying an exact version, lockfile, integrity hash, or verified artifact. Consequently, the installed code can change after the Skill has been reviewed.

npm packages can define lifecycle scripts that execute during installation. If the package registry account, package namespace, or a future release is compromised, following this instruction could execute attacker-controlled code. The audited project does not include the JavaScript SDK source, so the behavior and integrity of the downloaded package could not be independently verified.

Network access is necessary for the documented optional online discovery functionality, but installing mutable external executable content is not necessary merely to provide an informational development guide. The instruction therefore introduces avoidable supply-chain risk.

Attack Path

  1. An attacker compromises the npm publisher account, package namespace, or release process for agentpin.
  2. The attacker publishes a malicious package version or modifies package lifecycle behavior.
  3. A user or AI agent follows the unpinned npm install agentpin instruction.
  4. npm resolves the current compromised release because no exact reviewed version or integrity constraint is specified.
  5. Malicious installation scripts or subsequently imported package code execute with the privileges of the user running npm.
  6. The malicious code may access files, environment variables, credentials, or network resources available to that user.

Impact Assessment

Successful exploitation could result in arbitrary code execution under the installing user's account. The ...[truncated 327 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin the dependency to an exact, reviewed version rather than resolving the latest release.
  • Provide and enforce a committed lockfile containing npm integrity metadata.
  • Document the verified official package identity and publisher.
  • Use npm ci for reproducible installation where a lockfile is available.
  • Disable lifecycle scripts with --ignore-scripts when they are not required.
  • Review the resolved package contents and transitive dependencies before approving updates.
  • Prefer vendored or locally auditable source when the Skill is used in sensitive environments.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:128
Finding

Unpinned PyPI Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 128
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

bash
pip install agentpin

Technical Analysis

The guide instructs users or AI agents to install the agentpin package from PyPI without an exact version, hash verification, constraints file, or locally reviewed artifact. The command therefore resolves mutable external content whose behavior may differ from the version described by the audited documentation.

Python package installation may execute build-system or setup logic, particularly when a source distribution must be built. Even when installation itself does not execute malicious logic, importing the installed package can run attacker-controlled module initialization code. The Python SDK source is absent from the audited artifact, preventing independent verification of the downloaded implementation.

This creates a supply-chain boundary that is broader than necessary for an informational Skill and allows future registry content to alter the effective code used by an agent or developer.

Attack Path

  1. An attacker compromises the PyPI publisher account, package namespace, build process, or release artifact for agentpin.
  2. The attacker publishes a malicious release.
  3. A user or AI agent executes the documented unpinned pip install agentpin command.
  4. pip selects the compromised release because no reviewed version and artifact hash are enforced.
  5. Attacker-controlled code executes during package building, installation, or later import.
  6. That code accesses resources available to the Python environment and the invoking user.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the permissions of the user running pip or importing the package. Potential exposure includes source repositories, virtual-environment data, environment var ...[truncated 253 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin an exact reviewed package version.
  • Require hashes using a locked requirements file and pip install --require-hashes.
  • Prefer reviewed wheel artifacts and reject unexpected source distributions.
  • Document the verified PyPI project identity and publisher.
  • Audit direct and transitive dependencies before upgrading.
  • Install into an isolated, least-privileged virtual environment without unnecessary secrets.
  • Vendor or include auditable SDK source for high-assurance or offline deployments.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.