Automation Scripts

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:18 AM UTC
• Version: 1.1.0

Overview

This automation skill is coherent but needs Review because it can change files and create recurring tasks without clear safeguards or user-confirmation rules.

Review this skill before installing. Use it only with explicit paths and commands you understand, avoid running the installer with elevated privileges, prefer a pinned ClawHub installer version if available, and confirm how scheduled jobs are created and removed before using the scheduling feature.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:5

Finding

Unpinned Package Execution Through Mutable Latest Release

Content

View full analysis

Vulnerability Details

File Location: README.md:5-7
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Complete Code Snippet:

bash

npx clawhub@latest install automation-scripts

Technical Analysis

The documented installation procedure invokes npx with the mutable latest distribution tag. This may download and execute package code from the configured npm registry without constraining it to a reviewed version or integrity value. The repository does not include a lockfile, checksum, signature-verification procedure, or vendored implementation that would bind installation to known code.

Because the latest tag can be reassigned, the code executed by this command may differ from the code reviewed during this audit. Package installation can also trigger package entry points or lifecycle behavior under the privileges of the user running the command.

Attack Path

1. An attacker compromises the publisher account, registry package, registry resolution path, or a future release assigned to clawhub@latest.
2. The attacker publishes or designates a release containing malicious package code or installation behavior.
3. A user follows the README and runs npx clawhub@latest install automation-scripts.
4. npx retrieves the currently resolved release rather than a fixed, previously reviewed artifact.
5. The malicious package code executes with the invoking user's privileges and can access resources available to that user.

Impact Assessment

Successful exploitation could allow arbitrary code execution in the context of the user performing the installation. Potential scope includes reading or modifying user-accessible files, accessing environment variables and developer credentials, altering the installed skill, and making outbound network requests. System-wide impact would depend on whether the command is run with elevated privileges; the documentation does not ex ...[truncated 33 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the mutable latest tag with an exact, reviewed package version, such as clawhub@1.2.3.
• Publish and document a cryptographic integrity value or signature for the expected package artifact.
• Specify the trusted registry explicitly and ensure registry configuration cannot silently redirect package resolution.
• Review package entry points and lifecycle scripts before recommending execution through npx.
• Prefer a reproducible installation process backed by a lockfile or another mechanism that records exact dependency versions and integrity hashes.
• Advise users not to run the installation command with administrative privileges.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The README instructs users to run npx clawhub@latest install automation-scripts, which fetches and executes the latest package version at install time rather than a pinned, reviewed release. This creates a supply-chain risk: if the upstream package is compromised or a breaking/malicious update is published, users may execute untrusted code immediately.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This markdown file lists capabilities like batch renaming, automatic backup, data scraping, and scheduled commands, and includes examples that copy a workspace and run recurring screenshot jobs. The description does not include any user warning about possible file changes, storage usage, repeated execution, or privacy/system impact from automated operations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill advertises broad automation capabilities such as renaming files, backups, screenshots, scraping, and scheduling without documenting when it should or should not be invoked. That increases the chance an agent may apply it in overly broad contexts and perform state-changing actions on user systems without sufficiently explicit user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation includes backup, batch rename, and scheduled execution examples but provides no warning that these operations can alter user files or create persistent tasks. In an agent setting, omission of these safeguards is dangerous because users may not realize commands can modify data at scale or establish recurring execution.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill documentation is written in Chinese and does not indicate that other languages are supported or that the Chinese-only presentation is intentional for a region-specific use case. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The manifest description and introductory text are written in Chinese while the title is in English, and there is no indication that the skill is region-specific or that users may choose another language. This can violate language/locale policy when a specific language is imposed without opt-in or justification.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest does not define any activation conditions, trigger constraints, or scope limits, which can allow the skill to be invoked in broader contexts than intended. For an automation script skill, this increases the chance of unintended execution of batch or scheduled actions, especially since it declares access to an external binary (curl) that could be used in networked workflows.

Content

No source excerpt is available for this finding.