ClawHub
Back to skill

Security audit

Test

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent analytics purpose, but it asks users to run an unpinned external install plus non-sandboxed OAuth/GTM actions, so it should be reviewed before installation.

Install only if you trust the publisher and are comfortable with a non-sandboxed workflow that can access Google OAuth, local browser/OAuth callback behavior, and GTM containers. Prefer a pinned release or reviewed commit, keep `credentials.json` out of shared or synced folders, clear/revoke tokens when done, and verify every GTM target and publish prompt before approving changes.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:43
Finding

Unpinned External Installation Creates a Supply-Chain Execution Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 43
Vulnerability Type: Unpinned third-party package and Skill installation
Risk Level: Medium

Vulnerable Code Snippet:

markdown
- For public/ClawHub installs, you must run this first before any `event-tracking` command: `npx skills add jtrackingai/analytics-tracking-automation`.

Technical Analysis

The Skill requires an npx command that may download and execute the currently published version of the skills package. Neither that package nor the jtrackingai/analytics-tracking-automation Skill source is pinned to an immutable version, commit, or integrity hash.

This makes the effective installation behavior mutable after the audited bundle has been approved. A compromised package publisher, upstream account, registry entry, or Skill repository could therefore introduce behavior that was not present during this audit. Because the command is declared mandatory before any event-tracking command, users and agents are encouraged to execute the unreviewed upstream version automatically.

No evidence was found that the current upstream dependencies are malicious. The finding concerns the unsafe dependency-resolution mechanism and its resulting supply-chain exposure.

Attack Path

  1. An attacker compromises an upstream package, publisher account, registry entry, or the referenced Skill source.
  2. The attacker publishes a modified version containing malicious installation or runtime behavior.
  3. An agent follows the mandatory instruction in SKILL.md.
  4. npx resolves and retrieves the mutable upstream package, while the Skill installer retrieves the unpinned Skill revision.
  5. The changed code executes or is installed under the invoking user's identity without being represented in this audited project.
  6. The payload could access files, credentials, browser sessions, or network resources available to that user.

Impact Assessment

...[truncated 713 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the npx package to an exact reviewed version instead of resolving the latest release:

    bash
    npx --yes skills@<exact-version> add ...

  2. Pin the referenced Skill to an immutable commit, content digest, or signed release rather than a mutable repository reference.

  3. Verify package integrity through a lockfile, registry integrity digest, or cryptographic signature.

  4. Prefer bundling reviewed dependencies locally so normal execution does not retrieve mutable code.

  5. Require explicit user confirmation before downloading or executing third-party installation content.

  6. Perform installation in a least-privilege sandbox with restricted filesystem and network access.

  7. Establish a controlled upgrade process in which new dependency versions are reviewed and their hashes updated deliberately.

  8. Ensure artifact directories containing credentials.json are excluded from source control and inaccessible to unrelated local users.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (11)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/architecture.md (reported line 49)May include surrounding context.

md
| `schema_prepared` | approved `site-analysis.json` | `schema-context.json`, Shopify bootstrap artifacts when applicable | CLI-enforced |
| `schema_approved` | `event-schema.json` | approved schema hash in `workflow-state.json`, schema restore snapshot, schema decision audit, and optional `event-spec.md` | CLI-enforced |
| `gtm_generated` | approved `event-schema.json` | `gtm-config.json` | CLI-enforced |
| `synced` | `gtm-config.json` | `gtm-context.json`, `credentials.json`, Shopify sync artifacts when applicable | CLI-enforced |
| `verified` | `event-schema.json`, `gtm-context.json` | `preview-report.md`, `preview-result.json`, `tracking-health.json`, `tracking-health-history/` | CLI-enforced for command execution; release readiness is derived from tracking health |
| `published` | `gtm-context.json`, non-blocking `tracking-health.json` unless forced | live GTM container version | human confirmation plus CLI execution |

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/output-contract.md (reported line 71)May include surrounding context.

md
| `schema_prepared` | approved `site-analysis.json` | `schema-context.json`, Shopify bootstrap artifacts when applicable | CLI-enforced |
| `schema_approved` | `event-schema.json` | approved schema hash in `workflow-state.json`, schema restore snapshot, schema decision audit, and optional `event-spec.md` | CLI-enforced |
| `gtm_generated` | approved `event-schema.json` | `gtm-config.json` | CLI-enforced |
| `synced` | `gtm-config.json` | `gtm-context.json`, `credentials.json`, Shopify sync artifacts when applicable | CLI-enforced |
| `verified` | `event-schema.json`, `gtm-context.json` | `preview-report.md`, `preview-result.json`, `tracking-health.json`, `tracking-health-history/` | CLI-enforced for command execution; release readiness is derived from tracking health |
| `published` | `gtm-context.json`, non-blocking `tracking-health.json` unless forced | live GTM container version | human confirmation plus CLI execution |

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/output-contract.md (reported line 152)May include surrounding context.

md
| `schema_prepared` | approved `site-analysis.json` | `schema-context.json`, Shopify bootstrap artifacts when applicable | CLI-enforced |
| `schema_approved` | `event-schema.json` | approved schema hash in `workflow-state.json`, schema restore snapshot, schema decision audit, and optional `event-spec.md` | CLI-enforced |
| `gtm_generated` | approved `event-schema.json` | `gtm-config.json` | CLI-enforced |
| `synced` | `gtm-config.json` | `gtm-context.json`, `credentials.json`, Shopify sync artifacts when applicable | CLI-enforced |
| `verified` | `event-schema.json`, `gtm-context.json` | `preview-report.md`, `preview-result.json`, `tracking-health.json`, `tracking-health-history/` | CLI-enforced for command execution; release readiness is derived from tracking health |
| `published` | `gtm-context.json`, non-blocking `tracking-health.json` unless forced | live GTM container version | human confirmation plus CLI execution |

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/skill-map.md (reported line 9)May include surrounding context.

md
## Skill Map

<!-- contract-generated:runtime-skill-map:start -->
| Skill | Role | Use When | Typical Stop Point |
| --- | --- | --- | --- |
| `analytics-tracking-automation` | umbrella workflow router | the request is end-to-end, ambiguous, or spans multiple phases | whichever checkpoint matches the user intent |

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The skill instructs use of npx skills add jtrackingai/analytics-tracking-automation without pinning an exact version. That allows the fetched package or remote artifact to change over time, creating a supply-chain risk where users may execute unexpected code or updated behavior outside review. The danger is elevated here because the skill explicitly calls for non-sandboxed execution and interactive OAuth-backed steps.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

md
Rules:

- Do not ask the user to choose between internal workflow metadata flags and `analyze`.
- If intent is ambiguous, ask one short plain-language intake question using user-facing terms such as "new setup", "update existing tracking", "upkeep", "health audit", "analyze only", or "resume an existing run".
- If the user gives a fresh URL and asks to set up tracking, default to `new_setup`.
- If the user gives a fresh URL and only asks to inspect the site, analyze structure, or review current tracking signals, default to `analysis_only`.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The document explicitly instructs operators to run Playwright, sync, preview, and OAuth-related commands outside the sandbox because the sandbox may block browser automation and localhost callbacks. While operationally understandable, this weakens an important security boundary and does so without requiring an explicit risk acknowledgment or warning that the commands may access the local browser session, tokens, localhost callback listeners, and broader host environment. In a skill that automates GTM/GA4 setup and browser interaction, this increases the blast radius if the tool, dependencies, or target content behave unexpectedly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The documentation explicitly defines a local credentials.json OAuth token cache but only says 'never commit this file' without broader handling guidance such as restricting file permissions, encryption at rest, cleanup/rotation, or safe storage locations. Because this skill manages GA4/GTM publishing workflows, the cached token likely grants meaningful access to Google resources, so accidental exposure on shared machines, synced folders, or backups could enable unauthorized GTM changes or data access.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The file explicitly cites the Chinese phrase "全流程" as a broad request example. This introduces a language-specific policy choice in the skill instructions without stating that multilingual input is optional or that users may interact in their preferred language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

Line L49 states that groups should reflect the site's main language and that other language versions may not fully appear. This is a natural-language locale constraint that does not offer user opt-in or choice, and the file does not justify it as a region-specific or compliance-driven limitation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The phrase 'Use this as a generic English template' imposes a specific language for the report output. Under the policy rules, forcing a language without user opt-in or documented justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.