Goal Tracker Pro

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:59 AM UTC
• Version: 1.0.0

Overview

This is a simple goal-tracking skill with visible instructions and no embedded executable behavior, though its install command and unused curl requirement deserve caution.

Before installing, prefer a pinned and verified clawhub installer version if available, and note that the skill documentation is in Chinese. The unexplained curl requirement should be clarified by the publisher, but the submitted skill text does not show hidden execution, exfiltration, persistence, or destructive behavior.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:5

Finding

Execution of an Unpinned npm Package Through npx

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 5–7
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable Code:

bash

npx clawhub@latest install goal-tracker-pro

Technical Analysis

The documented installation command instructs users to download and execute the latest release of the third-party clawhub npm package. The @latest distribution tag is mutable and does not identify a specific, previously reviewed package version. No package integrity hash, lockfile, or trusted registry configuration is supplied.

When the package is not already available locally, npx can retrieve it from the configured npm registry and execute its command. Package lifecycle behavior and the invoked CLI consequently run with the permissions of the user executing the command. The project contains no local implementation through which the downloaded package's behavior can be independently reviewed.

This is a supply-chain weakness rather than evidence that the current clawhub package is malicious.

Attack Path

1. An attacker compromises the package, its publishing account, the relevant registry path, or another part of the package's dependency chain.
2. The attacker publishes a malicious release and causes the mutable latest tag to resolve to that release.
3. A user follows the installation command from README.md.
4. npx downloads the attacker-controlled package or dependency.
5. The package's executable or applicable installation behavior runs under the invoking user's account.
6. The payload can access resources available to that account, subject to operating-system controls and the execution environment.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the privileges of the user running npx. Depending on those privileges and the host environment, the payload could read or modify user-accessible files, access ...[truncated 288 chars]

Remediation

View remediation

Remediation Suggestions

• Replace @latest with an exact, reviewed package version, for example clawhub@X.Y.Z.
• Verify the selected release's provenance, publisher identity, dependency tree, and lifecycle scripts before recommending execution.
• Use lockfiles and registry-supported integrity metadata where the installation workflow permits them.
• Document the expected npm registry and prevent untrusted registry overrides in controlled deployment environments.
• Prefer a verified installer or locally audited implementation that does not execute mutable remote package content.
• Run installation with a non-privileged account in a restricted environment and avoid exposing unrelated credentials or sensitive environment variables.
• Establish a controlled update process so new package versions are reviewed and tested before the pinned version is changed.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill description and all user-facing documentation are presented in Chinese, and there is no indication that users can choose another language or that the skill is intended only for a Chinese-speaking or region-specific audience. This creates a natural-language policy concern because it imposes a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The README instructs users to run npx clawhub@latest install goal-tracker-pro, which relies on an unpinned, mutable package version. If the upstream package is compromised or a breaking/malicious release is published, users may execute attacker-controlled code during installation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest description and introductory text are written entirely in Chinese while the title is in English, and there is no indication that the skill supports multiple languages or that Chinese is a justified locale requirement. This can violate language/locale policy when a skill implicitly mandates a specific language without user choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.