ClawHub
Back to skill

Security audit

Qr Generator

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward QR-code generator description with no artifact-backed evidence of hidden execution, data theft, persistence, or destructive behavior.

Before installing, verify that you trust the ClawHub installer source and consider using a pinned installer version instead of `@latest`. Non-Chinese readers should translate or review the documentation carefully so they understand the pricing and command behavior.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:6
Finding

Execution of an Unpinned Mutable Package Release

Content
View full analysis

Vulnerability Details

File Location: README.md, line 6
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable Code Snippet:

bash
npx clawhub@latest install qr-generator

Technical Analysis

The documented installation command instructs users to download and execute the package version associated with the mutable latest npm distribution tag. The project does not pin an audited version or specify an integrity hash.

Because the package selected by latest can change after this skill has been reviewed, the code ultimately executed by users is not fixed to the audited project state. If the upstream package, maintainer account, publishing process, or package registry is compromised, a malicious release can be assigned to latest and executed through npx.

This finding concerns the supply-chain trust boundary created by the installation instruction. The audited repository itself contains no embedded executable implementation or confirmed malicious payload.

Attack Path

  1. An attacker compromises the clawhub package, its publisher credentials, or its release pipeline.
  2. The attacker publishes a malicious package version and assigns it to the latest distribution tag.
  3. A user follows the installation command in README.md.
  4. npx resolves and downloads the attacker-controlled release.
  5. Package lifecycle behavior or the invoked CLI executes with the privileges of the user running the command.
  6. The malicious release can access resources available to that user, subject to operating-system and runtime restrictions.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the invoking user's privileges. Depending on those privileges and the host environment, affected resources could include user-accessible files, environment variables, credentials, network services, and project data. If the command is run by a p ...[truncated 128 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace the mutable @latest reference with an exact, reviewed package version, for example clawhub@X.Y.Z.
  • Verify the selected release and document the expected package registry.
  • Use lockfiles and registry-supported integrity hashes where applicable.
  • Review package lifecycle scripts and transitive dependencies before recommending execution.
  • Upgrade only through a controlled process that reviews and tests each new version before changing the documented pin.
  • Avoid running package installation commands with administrative privileges.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

The README instructs users to run npx clawhub@latest install qr-generator, which pulls and executes the latest available package version rather than a pinned, reviewed release. If the upstream package or distribution path is compromised, users could execute attacker-controlled code during installation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest description and body text present the skill in Chinese only, which can constitute a language/locale policy violation when no user opt-in or alternative language is offered. The file does not state that the skill is region-specific or otherwise justify the language restriction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill documentation is written entirely in Chinese and does not indicate any user choice of language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

The manifest uses a non-English author/display string ("小鸣 🦞") without any indication that language choice is configurable or intentionally scoped to a specific locale. Under the stated policy, fixed language/locale presentation without opt-in can be a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.