ClawHub
Back to skill

Security audit

Skills

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent job-search assistant, but its installer and onboarding flow create review-worthy supply-chain and privacy risks.

Install only if you are comfortable with Coffee Shop receiving professional profile, application, and message data. Avoid the recommended curl-to-bash path; review installers first, prefer pinned or verified packages, and confirm what identity and profile data will be sent before registration or application submission.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:23
Finding

Unverified Remote Installer Is Piped Directly into Bash

Content
View full analysis
Remediation
View remediation
talentclaw-install.sh" | sha256sum -c - less talentclaw-install.sh bash talentclaw-install.sh ``` 6. Pin the download to an immutable release identifier rather than a mutable installation endpoint. 7. Document what files, packages, network services, and configuration locations the installer will modify. 8. Run installation with ordinary user privileges and request elevation only for a narrowly defined operation when unavoidable. ]]>

T03 · Remote Payload Retrieval and Execution

Error
Location
scripts/setup.sh:51
Finding

Setup Instructions Recommend Unverified Pipe-to-Shell Node.js Installers

Content
View full analysis
/dev/null; then echo " curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash -" echo " sudo apt-get install -y nodejs" elif command -v dnf &>/dev/null; then echo " curl -fsSL https://rpm.nodesource.com/setup_22.x | sudo bash -" echo " sudo dnf install -y nodejs" elif command -v yum &>/dev/null; then echo " curl -fsSL https://rpm.nodesource.com/setup_22.x | sudo bash -" echo " sudo yum install -y nodejs" ``` ### Technical Analysis These commands are printed as installation recommendations rather than executed automatically by `setup.sh`. That distinction limits immediate exploitability of the script itself, but users are still encouraged to copy and execute commands that stream remote content into a shell. The `fnm` and NodeSource endpoints are mutable. The nvm URL identifies a version tag, but the downloaded file is not authenticated using a checksum or signature. The NodeSource commands are especially dangerous because the remote response is executed through `sudo`, granting it root privileges. Installation documentation forms part of the Skill’s effective execution flow. Recommending unauthenticated remote shell execution unnecessarily expands the trust boundary and, for the NodeSource alternatives, violates least privilege. ### Attack Path 1. A user runs `scripts/setup.sh` on a system where Node.js is absent or older than version 22. 2. The script exits after printing the listed installation options. 3. The user copies one of the pipe-to-shell ...[truncated 1032 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
scripts/setup.sh:99
Finding

Unpinned npm Package Is Installed Globally

Content
View full analysis
/dev/null; then CURRENT_VERSION=$(coffeeshop version 2>/dev/null || echo "unknown") ok "coffeeshop CLI already installed (v${CURRENT_VERSION})" echo " To update: npm install -g @artemyshq/coffeeshop@latest" else info "Installing coffeeshop CLI globally..." if npm install -g @artemyshq/coffeeshop; then ok "coffeeshop CLI installed" ``` The same unpinned installation is also documented in `SKILL.md:42-46`: ```bash # 1. Install Node.js 22+ (https://nodejs.org) # 2. Install Coffee Shop CLI npm install -g @artemyshq/coffeeshop # 3. Register your agent identity coffeeshop register --display-name "Your Name" ``` ### Technical Analysis The setup installs `@artemyshq/coffeeshop` without specifying an exact version or integrity value. npm therefore resolves the package version from mutable registry metadata at installation time. A global npm installation may execute dependency lifecycle scripts and adds package-controlled executables to a global binary directory. A compromised publisher account, malicious future release, dependency takeover, or registry compromise could therefore cause arbitrary code to run during installation or whenever the globally installed `coffeeshop` command is invoked. The update recommendation explicitly uses `@latest`, further ensuring that unaudited future releases are trusted automatically. ### Attack Path 1. An attacker compromises the npm publisher account, a transitive dependency, or the release pipeline. 2. The attacker publishes a malicious version or changes the version referenced by the latest distribution tag. 3. A new user runs `scripts/setup.sh`, or an existing user follows the printed update command. 4. npm resolves and downloads the malicious package version. 5. Package li ...[truncated 823 chars]
Remediation
View remediation
``` 2. Publish and verify package integrity information. 3. Review direct and transitive dependencies for each released version. 4. Avoid global installation where possible; use a project-local dependency with a lockfile. 5. Do not recommend `@latest` for security-sensitive tools. 6. Avoid suggesting `sudo npm install -g`. 7. Evaluate whether npm lifecycle scripts are required; disable them with `--ignore-scripts` if they are unnecessary. 8. Document a controlled update process that requires review before changing the pinned version. 9. Ensure the Coffee Shop package name and publisher identity are verified to reduce dependency-confusion and account-spoofing risks. ]]>

other

Warning
Location
scripts/setup.sh:126
Finding

Setup Automatically Discloses a Locally Derived Identity to an External Service

Content
View full analysis
/dev/null; then DISPLAY_NAME=$(git config --global user.name 2>/dev/null || true) fi if [ -z "$DISPLAY_NAME" ]; then DISPLAY_NAME=$(whoami) fi if coffeeshop register --display-name "$DISPLAY_NAME"; then ok "Agent identity registered as \"$DISPLAY_NAME\"" ``` ### Technical Analysis When no Coffee Shop configuration exists, the setup reads either the user’s global Git display name or local operating-system username and passes it to `coffeeshop register`. Registration communicates with the external Coffee Shop service and creates persistent credentials in `~/.coffeeshop/config.json`. External registration is related to the Skill’s declared network functionality. However, the script does not display the derived name and request confirmation before transmitting it. A global Git name may be a person’s real professional identity, while an operating-system username may reveal an internal naming convention, email-derived identifier, or other information the user did not intend to publish. The setup also combines dependency installation, identity creation, credential persistence, diagnostics, and MCP-server execution into one process without providing a registration opt-out. ### Attack Path 1. A user runs `scripts/setup.sh` without an existing `~/.coffeeshop/config.json`. 2. The script reads `git config --global user.name`. 3. If that value is unavai ...[truncated 954 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (32)

External Script Fetching

High
Category
Supply Chain
Confidence
99% confidence
Finding

The installation path fetches a remote script over the network and executes it immediately. This is dangerous because any compromise of skills.sh, DNS/TLS interception, or upstream supply-chain tampering can result in arbitrary code execution on the host with the user's privileges, and the skill already expects network access and further package installation.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

skills.sh (recommended)

bash
curl -fsSL https://skills.sh/i/talentclaw | bash

This installs talentclaw and its dependencies (Node.js 22+, Coffee Shop CLI) automatically. Works on macOS and Linux.

Chaining Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

The | bash pipeline is a classic command-chaining anti-pattern that converts untrusted network content directly into shell execution. In this skill's context, the danger is amplified because the skill is designed for action-taking and external connectivity, so a compromised installer could silently implant malware, exfiltrate local career data, or alter the agent environment before the user notices.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

skills.sh (recommended)

bash
curl -fsSL https://skills.sh/i/talentclaw | bash

This installs talentclaw and its dependencies (Node.js 22+, Coffee Shop CLI) automatically. Works on macOS and Linux.

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
55% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · references/APPLICATION-PLAYBOOK.md (reported line 45)May include surrounding context.

md
- **Do not restate your resume.** The employer agent already has your candidate snapshot. Match reasoning should add context and narrative, not repeat bullet points.
- **Do not use generic enthusiasm.** "I'm excited about this opportunity" says nothing. Say why -- the specific product, problem, or team.
- **Do not apologize for gaps.** If you lack a requirement, either address it with adjacent experience or skip it. Never lead with what you cannot do.
- **Do not waste characters on filler.** Skip "Dear Hiring Manager" and "Thank you for your consideration." Get to the substance.
- **Do not copy-paste the same reasoning across applications.** Employer agents may compare applications. Each one should reference the specific posting.

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/setup.sh (reported line 52)May include surrounding context.

sh
echo "  Option D (direct):    https://nodejs.org/en/download"
  else
    echo "  Option A (nvm):       curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.3/install.sh | bash && nvm install 22"
    echo "  Option B (fnm):       curl -fsSL https://fnm.vercel.app/install | bash && fnm install 22"
    echo "  Option C (NodeSource):"
    if command -v apt-get &>/dev/null; then
      echo "    curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash -"

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · scripts/setup.sh (reported line 55)May include surrounding context.

sh
echo "  Option B (fnm):       curl -fsSL https://fnm.vercel.app/install | bash && fnm install 22"
    echo "  Option C (NodeSource):"
    if command -v apt-get &>/dev/null; then
      echo "    curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash -"
      echo "    sudo apt-get install -y nodejs"
    elif command -v dnf &>/dev/null; then
      echo "    curl -fsSL https://rpm.nodesource.com/setup_22.x | sudo bash -"

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · scripts/setup.sh (reported line 58)May include surrounding context.

sh
echo "  Option B (fnm):       curl -fsSL https://fnm.vercel.app/install | bash && fnm install 22"
    echo "  Option C (NodeSource):"
    if command -v apt-get &>/dev/null; then
      echo "    curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash -"
      echo "    sudo apt-get install -y nodejs"
    elif command -v dnf &>/dev/null; then
      echo "    curl -fsSL https://rpm.nodesource.com/setup_22.x | sudo bash -"

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · scripts/setup.sh (reported line 61)May include surrounding context.

sh
echo "  Option B (fnm):       curl -fsSL https://fnm.vercel.app/install | bash && fnm install 22"
    echo "  Option C (NodeSource):"
    if command -v apt-get &>/dev/null; then
      echo "    curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash -"
      echo "    sudo apt-get install -y nodejs"
    elif command -v dnf &>/dev/null; then
      echo "    curl -fsSL https://rpm.nodesource.com/setup_22.x | sudo bash -"

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · scripts/setup.sh (reported line 118)May include surrounding context.

sh
or configure npm prefix"
      echo "    mkdir -p ~/.npm-global && npm config set prefix ~/.npm-global"
      echo "    Add ~/.npm-global/bin to your PATH"
    else
      echo "  - If permission denied: sudo npm install -g @artemyshq/coffeeshop"
      echo "  - Or configure npm to install globally without sudo:"
      echo "    mkdir -p ~/.npm-global && npm config set prefix ~/.npm-global"
      echo "    echo 'export PATH=~/.npm-global/bin:\$PATH' >> ~/.bashrc && source ~/.bashrc"
    fi
    exit 1
  fi
fi

# ─── 4. Initialize agent identity ───────────────────────────────────────────

CONFIG_FILE="$HOME/.coffeeshop/config.json"
if [ -f "$CONFIG_FILE" ]; then
  ok "Agent identity already initialized (~/.coffeeshop/config.json exists)"
else
  echo ""
  info "Registering agent identity..."
  echo "This will create your agent card and register with Coffee Shop."
  echo ""

  # Use display name fr

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill explicitly instructs the agent to run shell commands (bash, npm, coffeeshop) and perform networked actions, but it does not declare any permissions or allowed-tools scope. That creates a least-privilege failure: a host agent may invoke shell capability without an explicit consent boundary, increasing the chance of unintended command execution, installation, or data transmission.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The top-level description presents the skill as a career helper but does not clearly warn that profile data, applications, and employer messages are sent to an external hub (coffeeshop.sh). This weakens informed consent: users may provide resumes, compensation expectations, locations, and recruiter communications without realizing that the data will leave the local environment.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger phrases are broad enough to activate during ordinary conversation, including generic requests like "find me a job" or "check my inbox." Over-broad activation is risky here because this skill can register identities, access inboxes, update profiles, and send messages over the network, so accidental invocation can lead to unintended external actions and disclosure of personal data.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
88% confidence
Finding

This section normalizes ongoing recruiter communication and quick responses, and in context the skill is designed to maintain continuing interaction state across sessions. Because the skill also stores messages and profile state locally and routes communications through a hub, session persistence increases the risk of retaining sensitive professional data and continuing external communication beyond what the user intended.

Content

Scanner excerpt · SKILL.md (reported line 193)May include surrounding context.

md
### Communication

Your messages may reach human recruiters. Write accordingly.

- **Professional but human.** Not stiff corporate language, not casual texting. Write like a competent professional who respects the reader's time.
- **Interview scheduling:** Provide 3-4 specific time slots across 2-3 days. Always include timezone. Respond within 24 hours.

Session Persistence

Medium
Category
Rogue Agent
Confidence
95% confidence
Finding

The skill persists substantial user data in ~/.talentclaw/, including profile details, applications, contacts, messages, and an append-only activity log. Persistent local storage is not inherently malicious, but it materially increases exposure of sensitive career and communication data if the workstation, agent environment, or backups are compromised, especially because the file store is treated as a shared database across runtimes.

Content

Scanner excerpt · SKILL.md (reported line 267)May include surrounding context.

md
- **`express_interest`** requires a `job_id` from search results. The `match_reasoning` field (max 4000 chars) is your cover letter -- always include it for Tier 1 and Tier 2 applications.
- **`update_profile`** syncs to the Coffee Shop hub automatically. Changes are reflected in search results within minutes.
- **`check_inbox`** with `--unread-only` keeps your inbox manageable during active search.
- **`respond_to_message`** sends through the hub. Messages may reach human recruiters, so write accordingly.

See [Tool & CLI Reference](references/TOOLS.md) for full schemas, parameters, and return types.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The update_profile documentation states that candidate profile data is validated, stored, and synced to the Coffee Shop hub, but it does not clearly warn that personal employment data will be transmitted and stored externally. In a career-advisor context, this can cause users or agents to share sensitive profile details without informed consent, creating privacy and compliance risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The express_interest documentation describes submitting an application using the stored candidate profile and optional reasoning, but it does not explicitly warn that this information will be sent to external employers or recruiters. That omission is dangerous because application content may contain sensitive personal or professional details, and an autonomous agent could disclose them without sufficiently informed user approval.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The documented register_agent capability goes beyond a typical end-user career-advisor workflow by enabling creation of agent identities and issuance of an API key. In an agent skill context, exposing identity registration and one-time credential return increases the chance an agent could be steered into provisioning or handling credentials unrelated to the user's immediate career task, expanding attack surface and enabling account creation or credential misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The registration section returns an API key and notes that the CLI saves it to ~/.coffeeshop/config.json, but it lacks strong credential-handling guidance such as treating the key as secret, avoiding logs/chat output, and securing local storage. In an agent environment, this is especially risky because one-time secrets may be exposed in transcripts, tool output, or insecure files, leading to account takeover or unauthorized use of the Coffee Shop account.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/setup.sh (reported line 55)May include surrounding context.

sh
echo "  Option B (fnm):       curl -fsSL https://fnm.vercel.app/install | bash && fnm install 22"
    echo "  Option C (NodeSource):"
    if command -v apt-get &>/dev/null; then
      echo "    curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash -"
      echo "    sudo apt-get install -y nodejs"
    elif command -v dnf &>/dev/null; then
      echo "    curl -fsSL https://rpm.nodesource.com/setup_22.x | sudo bash -"

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/setup.sh (reported line 56)May include surrounding context.

sh
echo "  Option B (fnm):       curl -fsSL https://fnm.vercel.app/install | bash && fnm install 22"
    echo "  Option C (NodeSource):"
    if command -v apt-get &>/dev/null; then
      echo "    curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash -"
      echo "    sudo apt-get install -y nodejs"
    elif command -v dnf &>/dev/null; then
      echo "    curl -fsSL https://rpm.nodesource.com/setup_22.x | sudo bash -"

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/setup.sh (reported line 58)May include surrounding context.

sh
echo "  Option B (fnm):       curl -fsSL https://fnm.vercel.app/install | bash && fnm install 22"
    echo "  Option C (NodeSource):"
    if command -v apt-get &>/dev/null; then
      echo "    curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash -"
      echo "    sudo apt-get install -y nodejs"
    elif command -v dnf &>/dev/null; then
      echo "    curl -fsSL https://rpm.nodesource.com/setup_22.x | sudo bash -"

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/setup.sh (reported line 59)May include surrounding context.

sh
echo "  Option B (fnm):       curl -fsSL https://fnm.vercel.app/install | bash && fnm install 22"
    echo "  Option C (NodeSource):"
    if command -v apt-get &>/dev/null; then
      echo "    curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash -"
      echo "    sudo apt-get install -y nodejs"
    elif command -v dnf &>/dev/null; then
      echo "    curl -fsSL https://rpm.nodesource.com/setup_22.x | sudo bash -"

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/setup.sh (reported line 61)May include surrounding context.

sh
echo "  Option B (fnm):       curl -fsSL https://fnm.vercel.app/install | bash && fnm install 22"
    echo "  Option C (NodeSource):"
    if command -v apt-get &>/dev/null; then
      echo "    curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash -"
      echo "    sudo apt-get install -y nodejs"
    elif command -v dnf &>/dev/null; then
      echo "    curl -fsSL https://rpm.nodesource.com/setup_22.x | sudo bash -"

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/setup.sh (reported line 62)May include surrounding context.

sh
echo "  Option B (fnm):       curl -fsSL https://fnm.vercel.app/install | bash && fnm install 22"
    echo "  Option C (NodeSource):"
    if command -v apt-get &>/dev/null; then
      echo "    curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash -"
      echo "    sudo apt-get install -y nodejs"
    elif command -v dnf &>/dev/null; then
      echo "    curl -fsSL https://rpm.nodesource.com/setup_22.x | sudo bash -"

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/setup.sh (reported line 115)May include surrounding context.

sh
echo "  Option B (fnm):       curl -fsSL https://fnm.vercel.app/install | bash && fnm install 22"
    echo "  Option C (NodeSource):"
    if command -v apt-get &>/dev/null; then
      echo "    curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash -"
      echo "    sudo apt-get install -y nodejs"
    elif command -v dnf &>/dev/null; then
      echo "    curl -fsSL https://rpm.nodesource.com/setup_22.x | sudo bash -"

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/setup.sh (reported line 55)May include surrounding context.

sh
echo "  Option B (fnm):       curl -fsSL https://fnm.vercel.app/install | bash && fnm install 22"
    echo "  Option C (NodeSource):"
    if command -v apt-get &>/dev/null; then
      echo "    curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash -"
      echo "    sudo apt-get install -y nodejs"
    elif command -v dnf &>/dev/null; then
      echo "    curl -fsSL https://rpm.nodesource.com/setup_22.x | sudo bash -"

Static analysis

No suspicious patterns detected.