Batch Search Monitor

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:27 AM UTC
• Version: 1.0.0

Overview

The skill’s search-monitoring purpose is coherent, but its install instructions ask users to run a mutable remote npm installer, so it should be reviewed before use.

Review the installer provenance before installing, avoid running the npx command with administrator privileges, and prefer a pinned ClawHub installer version if one is available. After installation, verify what scheduled monitor tasks are created and how notifications and exported data are stored.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:7

Finding

Unpinned npm Package Download and Execution

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 7-9
Vulnerability Type: Unsafe execution of a mutable third-party dependency
Risk Level: Medium

Vulnerable Code:

bash

npx clawhub@latest install batch-search-monitor

Technical Analysis

The documented installation procedure uses npx with the mutable latest tag. When followed, this command may download and immediately execute whichever version of the clawhub npm package is currently associated with that tag.

The command does not pin a reviewed package version or verify the downloaded package using an integrity hash. The audited artifact also does not contain the external CLI implementation, so its effective installation behavior cannot be verified from the project files. A future package release, compromised maintainer account, or compromised publication process could therefore change the code executed by this command after the Skill has been reviewed.

Attack Path

1. An attacker compromises the npm package maintainer, publication credentials, package namespace, or another part of the package distribution process.
2. The attacker publishes a malicious release of clawhub and assigns it to the latest distribution tag.
3. A user follows the installation instructions in README.md.
4. npx retrieves the attacker-controlled release from the configured npm registry.
5. The downloaded package executes as the user running the installation command.
6. The malicious release can perform actions allowed by that user's operating-system permissions.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the user running npx. Depending on those privileges and the host configuration, the malicious package could read or modify user-accessible files, access environment variables and credentials, make network requests, install additional software, or alter the user's development envir ...[truncated 299 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the mutable @latest reference with an exact, reviewed package version, such as clawhub@X.Y.Z.
2. Verify the selected package version and its transitive dependencies before recommending it.
3. Use lockfiles and registry-provided integrity metadata where supported.
4. Document the expected npm registry and trusted package provenance to reduce dependency-confusion risk.
5. Prefer a controlled installation process that downloads and verifies an artifact before execution rather than combining retrieval and execution in one command.
6. Establish an update process in which new package versions are security-reviewed before the documented version is changed.
7. Advise users not to run the installation command with administrator or root privileges.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill description is written in Chinese and provides no indication that other languages are supported or that the Chinese-only presentation is a justified region-specific constraint. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The README instructs users to run npx clawhub@latest install batch-search-monitor, which fetches and executes the latest published version of a remote package at install time. Because the version is not pinned, a compromised, malicious, or breaking upstream release of clawhub could immediately execute arbitrary code on a user's machine during installation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The natural-language description and feature list state the skill is for Chinese search monitoring and explicitly supports only Chinese search engines. This imposes a specific language/locale context without offering user choice or documenting a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The description field forces a single language presentation in natural-language metadata, which can violate language/locale policy when no opt-in or scope limitation is provided. There is no indication that the skill is intended only for Chinese-speaking users or that alternate language support is optional.

Content

No source excerpt is available for this finding.