Roundtable by JZ

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 2:19 AM UTC
• Version: 1.0.0

Overview

This is a prompt-only decision-analysis skill with some broad activation and installer-version cautions, but no hidden code, persistence, data access, or destructive behavior in the reviewed artifact.

Install from a trusted ClawHub source and prefer a pinned installer version when possible. Expect the skill to add a structured multi-role discussion to decision requests; invoke it explicitly for sensitive topics so it does not unnecessarily shape ordinary tasks.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:16

Finding

Unpinned npm Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: README.md, line 16
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Complete Code Snippet:

bash

npx clawhub@latest install roundtable

Technical Analysis

The documented installation command instructs npx to resolve, download, and execute the clawhub package identified by the mutable latest distribution tag. It does not pin the dependency to a reviewed version or integrity hash.

Because latest may point to a different release after this Skill has been audited, the effective code executed during installation is not fixed by the repository. npm package code and applicable lifecycle behavior execute with the invoking user's privileges. This creates a supply-chain boundary in which compromise of the package, a maintainer account, the release process, or an upstream dependency could result in execution of unreviewed code.

This finding concerns the installation guidance. The audited project itself contains only Markdown files and does not include an embedded executable payload.

Attack Path

1. An attacker compromises the clawhub package, its publisher account, its release pipeline, or a dependency included in a subsequent release.
2. The attacker publishes a malicious version and causes the mutable latest tag to resolve to it.
3. A user follows the installation command from README.md.
4. npx downloads and executes package-controlled code without enforcing the version reviewed during this audit.
5. Malicious code runs under the privileges and environment of the user who invoked the command.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the installing user's privileges. Depending on those privileges and the host environment, the malicious package could access user-readable files and credentials, alter project files, make network requests, install persistence, or modify other r ...[truncated 305 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the mutable latest tag with an explicitly reviewed package version, for example:

   bash

   npx clawhub@<reviewed-version> install roundtable
   

2. Record and verify package provenance and integrity through a trusted lockfile, registry policy, checksum, signature, or npm provenance mechanism where supported.

3. Review the selected package version, its transitive dependencies, and relevant lifecycle scripts before recommending execution.

4. Prefer a workflow that downloads and verifies the package before executing it when operationally feasible.

5. Run installation with the minimum necessary privileges in an isolated environment; do not invoke it as an administrator or root user.

6. Use an approved registry and dependency allowlist in managed environments to reduce package substitution and account-compromise risks.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Natural-Language Policy Violations

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill includes hardcoded Chinese instructions that dictate execution behavior and language/context handling without user opt-in, which can conflict with user preferences and higher-level agent policies. More importantly, those instructions direct the agent to remain in the main session and avoid isolation, increasing risk if the skill is invoked during sensitive operations because analysis and potentially risky guidance stay in the primary context.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The installation command uses npx clawhub@latest, which pulls and executes the latest published package version at runtime rather than a reviewed, pinned version. If the upstream package is compromised, typosquatted, or updated with malicious code, users following the README could execute attacker-controlled code on their system.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill’s activation guidance is broad enough that it could trigger on generic 'important decisions' rather than an explicit user request, causing unsolicited mode-switching and over-application of the skill. In an agent system, ambiguous triggers can override normal instruction selection and lead to the wrong workflow being applied in sensitive contexts such as trading, public posting, or system changes.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.