ClawHub
Back to skill

Security audit

Hiking Tracker

Security checks for vulnerabilities and agentic risk

Overview

This is a simple hiking-tracker documentation skill with no bundled executable payload, though its README uses a mutable npx install command users should treat cautiously.

Before installing, consider using a pinned and trusted ClawHub installer version instead of `@latest`, and review that the Chinese-language interface and hiking examples fit your needs. Do not run the install command with elevated privileges unless you independently trust the installer path.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:6
Finding

Unpinned Third-Party Package Execution in Installation Instructions

Content
View full analysis

Vulnerability Details

File Location: README.md:6
Vulnerability Type: Supply-chain risk caused by executing a mutable package release
Risk Level: Medium

Vulnerable Code Snippet:

bash
npx clawhub@latest install hiking-tracker

Technical Analysis

The documented installation command instructs users to download and execute the latest release of the third-party npm package clawhub. The latest tag is mutable and does not identify a specific, audited package version or integrity hash. Consequently, the code executed by this command may change after the Skill has been reviewed.

npx can download and run package code as the current user. If the package publisher account, npm distribution channel, or a future package release is compromised, following the documented installation procedure could execute attacker-controlled code. The repository provides no lockfile, checksum, signature-verification procedure, or pinned version that would allow users to verify the fetched package against a known-good artifact.

This finding establishes an unsafe dependency-execution pattern; it does not establish that the current clawhub package is malicious.

Attack Path

  1. An attacker compromises the npm publisher account, package distribution path, or release process for clawhub.
  2. The attacker publishes a malicious release and assigns it the mutable latest tag.
  3. A user follows the installation command documented in README.md.
  4. npx retrieves the attacker-controlled package release.
  5. Package lifecycle behavior or the invoked CLI executes with the privileges of the user running the command.
  6. The malicious package can access or modify resources available to that user before or while processing the Skill installation.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the installing user's account. The attainable scope includes reading user-accessi ...[truncated 465 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace @latest with an explicitly reviewed and pinned package version, for example:

    bash
    npx clawhub@<reviewed-version> install hiking-tracker

  2. Verify the selected package version and publisher before documenting it.

  3. Record and validate the expected package integrity hash or use a lockfile-backed installation workflow where applicable.

  4. Prefer a trusted internal registry or an independently verifiable signed release when the installation tooling supports it.

  5. Configure CI or dependency-monitoring controls to review version changes rather than automatically following mutable tags.

  6. Document that users should not run the installation command with administrative privileges.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The README instructs users to run npx clawhub@latest install hiking-tracker, which pulls and executes the latest published package version at install time rather than a pinned, audited version. If the upstream package or dependency chain is compromised, users could execute attacker-controlled code during installation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest description and nearly all user-facing instructions are written in Chinese, which imposes a specific language on users. The file does not offer an opt-in choice of language or explain that the skill is intended only for a Chinese-speaking or region-specific audience.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README content describing the skill is written entirely in Chinese, with no indication that users can choose another language or that the skill is intentionally limited to a Chinese-speaking or region-specific audience. This creates a natural-language locale policy concern because the skill presentation implicitly enforces a specific language without opt-in.

Content

No source excerpt is available for this finding.