clawtip-skill

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:08 AM UTC
• Version: 1.0.11

Overview

This is a reference-only developer guide with no bundled executable code, though users should treat the suggested external npx sandbox command as third-party code execution.

Installers should understand this skill is documentation, not a payment processor. Before following the recommended npx sandbox command, verify the @clawtip/clawtip-sandbox-cli package and run it only in a least-privileged test environment without production secrets.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:67

Finding

Unverified Third-Party Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 67
Vulnerability Type: Third-party supply-chain exposure
Risk Level: Medium

Vulnerable Code Snippet:

markdown

- 沙箱测试：`npx @clawtip/clawtip-sandbox-cli@1.0.0 pay`

Technical Analysis

The documentation instructs users to execute @clawtip/clawtip-sandbox-cli through npx. If the specified package is not already available locally, npx can retrieve it from the configured npm registry and execute its lifecycle or runtime code with the user's privileges.

Pinning the package to version 1.0.0 reduces version drift, but it does not authenticate the publisher or verify the downloaded artifact against a trusted integrity hash. The package source and exact distributed artifact are not included in this project, so their behavior could not be assessed during this audit.

This creates a dependency supply-chain risk: compromise of the package, publisher account, registry, configured registry mirror, or local package cache could cause attacker-controlled code to run when a user follows the documented command.

Attack Path

1. An attacker compromises the referenced npm package, its publisher account, an upstream registry or mirror, or the user's package-resolution environment.
2. The user follows the sandbox-testing instruction in SKILL.md.
3. npx resolves and retrieves the referenced package from the configured registry or cache.
4. Package lifecycle scripts or the package entry point execute on the user's system.
5. Malicious code runs with the permissions and environment access of the invoking user.

Impact Assessment

Successful exploitation could permit arbitrary code execution under the invoking user's account. Depending on that account's permissions and environment, the malicious dependency could access readable files, environment variables, developer credentials, source repositories, and network resources, or modify user-writable ...[truncated 290 chars]

Remediation

View remediation

Remediation Suggestions

1. Avoid directing users to download and execute registry content in a single command.
2. Provide the package's official source repository, publisher identity, and release-verification instructions.
3. Require verification of the exact package artifact using trusted integrity metadata, checksums, signatures, or npm provenance before execution.
4. Prefer a dependency installed through a lockfile-controlled project workflow and invoke the verified local binary rather than allowing npx to download it automatically.
5. Disable or inspect dependency lifecycle scripts during installation where operationally feasible.
6. Execute sandbox tooling in an isolated, least-privileged environment without production credentials or sensitive files.
7. Independently audit the referenced clawtip and clawtip-sandbox components because their implementations are not included in this project.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Line L44 states that error messages must be in English because Chinese messages would be flagged, which is a natural-language locale constraint presented as a requirement. This forces a specific language rather than offering a user choice or documenting a justified region-specific limitation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.