Security audit

Cycling Tracker

Security checks for vulnerabilities and agentic risk

Overview

This is a simple cycling-tracker skill with disclosed CLI examples and no artifact-backed evidence of hidden, destructive, or credential-seeking behavior.

Before installing, consider pinning the ClawHub installer to a reviewed version instead of using `@latest`, and verify why the package declares a `curl` requirement. The skill itself appears limited to cycling-tracking commands and does not request credentials or persistent system access.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: README.md:6
Finding: Unpinned Remote Package Execution Through npx
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The install command uses npx clawhub@latest, which fetches and executes the latest published package version at install time rather than a pinned, reviewed release. This creates a supply-chain risk: if the package or one of its distribution paths is compromised later, users following the README could run attacker-controlled code.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest description and introductory text present the skill in Chinese only, which can amount to a language policy violation when no user opt-in or alternative language option is provided. Nothing in the file indicates that this skill is intended only for a Chinese-speaking or region-specific audience.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill description is presented in Chinese at L03, and the rest of the README headings and content continue in Chinese without indicating any language choice or user opt-in. This can violate a language/locale policy when users are not given an explicit option to use another language.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.