Clawdhub Copy

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:52 AM UTC
• Version: 1.0.0

Overview

The skill is a disclosed ClawdHub CLI helper, but it includes broad, noninteractive update instructions and an unpinned global npm install that warrant review before use.

Review before installing. Prefer installing a specific reviewed `clawdhub` version, avoid elevated/global installs when possible, and do not use `update --all --no-input --force` unless you intentionally want every installed skill changed without prompts in a controlled setting.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:4

Finding

Unpinned Global npm Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 4 and 9–12
Vulnerability Type: Unpinned third-party package installed globally
Risk Level: Medium

Vulnerable Code

yaml

metadata: {"clawdbot":{"requires":{"bins":["clawdhub"]},"install":[{"id":"node","kind":"node","package":"clawdhub","bins":["clawdhub"],"label":"Install ClawdHub CLI (npm)"}]}}

bash

npm i -g clawdhub

Technical Analysis

The skill directs users to install the latest available version of the third-party clawdhub npm package globally, without pinning a reviewed version or verifying package integrity. The metadata likewise specifies only the package name.

Consequently, the code installed when the instruction is followed can change after this skill has been audited. npm packages may execute lifecycle scripts during installation. If the package, its maintainer account, or one of its transitive dependencies is compromised, attacker-controlled code could execute with the privileges of the user running npm. Global installation also places the resulting executable in a shared command path, increasing its reach beyond this skill.

No evidence establishes that the current clawdhub package is malicious. The confirmed issue is the unsafe, unpinned dependency-installation practice and the resulting supply-chain exposure.

Attack Path

1. An attacker compromises the clawdhub npm package, a maintainer account, or a transitive dependency, and publishes a malicious release.
2. A user or agent follows SKILL.md and executes npm i -g clawdhub without selecting a reviewed version or checking integrity.
3. npm retrieves the attacker-controlled release and may run its lifecycle scripts during installation.
4. Malicious code executes with the installing user's privileges.
5. The globally installed executable can subsequently run whenever the user or agent invokes clawdhub.

Impact Assessment

Successful exploitati ...[truncated 457 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a specifically reviewed release in both metadata and installation instructions, for example:

   bash

   npm install --global clawdhub@<reviewed-version>
   

2. Record and verify the expected package integrity hash or install through a lockfile-backed, reproducible process.
3. Review the pinned package, its transitive dependencies, and npm lifecycle scripts before approval.
4. Prefer a project-local installation rather than a global installation, then invoke the pinned local binary.
5. Disable npm lifecycle scripts with --ignore-scripts when they are not required. If scripts are required, inspect them before installation.
6. Avoid elevated installation privileges and execute the CLI under a least-privileged account or sandbox.
7. Establish a controlled upgrade process in which new versions are reviewed and their integrity is verified before changing the pin.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill includes a bulk update example using clawdhub update --all --no-input --force, which can overwrite or change all installed skills without confirmation and without any warning about the risks. In this context, the skill is specifically designed to fetch and modify executable agent skills from an external registry, so a forced non-interactive update increases the chance of silently introducing breaking or unsafe changes across the local skill set.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.