ClawHub
Back to skill

Security audit

Discord Doctor

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Discord/Clawdbot troubleshooting guide with repair commands that match its stated purpose, though users should be careful with its package-install and cleanup actions.

Install only if you expect it to manage Clawdbot/Discord gateway health. Review --fix actions before running them, since they may install npm packages, restart the gateway, remove an old launchd service, and move ~/.clawdis to a backup. For OAuth reauthentication, prefer a trusted local or pinned clawdbot package instead of allowing npx to fetch an arbitrary latest version.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:52
Finding

Unpinned npm Package Retrieval and Execution Through npx

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 52–56
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

markdown
If you see "Access token EXPIRED", run:
```bash
cd ~/Clawdis && npx clawdbot configure

Then select "Anthropic OAuth (Claude Pro/Max)" to re-authenticate.

text

### Technical Analysis

The recommended command executes `npx clawdbot configure` without specifying a reviewed package version or integrity digest. If `clawdbot` is not already available locally, `npx` may download the package selected by npm registry resolution and execute its CLI code with the invoking user's permissions.

Because package resolution is unpinned, the code executed by this instruction can change after the Skill has been audited. A compromised package release, registry account, registry configuration, or dependency in the resolved package could therefore introduce attacker-controlled code. The project contains no lockfile, package manifest, integrity metadata, or implementation that constrains this resolution.

### Attack Path

1. An attacker compromises the npm package, a transitive dependency, its publishing account, or a registry used by the victim.
2. The attacker publishes a malicious version that is selected by unpinned npm resolution.
3. A user encounters the documented OAuth-expiration condition and follows the instruction in `SKILL.md`.
4. The user runs `npx clawdbot configure`.
5. If a verified local package is unavailable, `npx` retrieves the attacker-controlled package version and executes its CLI or applicable lifecycle code.
6. The malicious code operates with the permissions of the user who invoked the command.

### Impact Assessment

Successful exploitation could permit arbitrary code execution under the invoking user's account. Within that user's privileges, malicious package code could read or modify accessible files, alter the Clawdbot installation or configurat
...[truncated 413 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin clawdbot to an explicitly reviewed version rather than relying on the registry's current resolution.
  2. Define dependencies in a controlled project manifest and commit the corresponding lockfile.
  3. Enforce package integrity verification through lockfile integrity hashes and a trusted npm registry.
  4. Prefer invoking an already installed and verified local binary, such as through an npm script, instead of allowing npx to download code on demand.
  5. If npx remains necessary, use an exact package version, disable interactive package installation where supported, and verify package provenance before execution.
  6. Audit the selected package and its transitive dependencies, including lifecycle scripts, before distributing the instruction.
  7. Run configuration tooling with the least privileges required and avoid executing it from an elevated shell.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.