ClawHub
Back to skill

Security audit

Todo Manager

Security checks for vulnerabilities and agentic risk

Overview

This is a simple todo-management skill with no hidden code or deceptive instructions, though its README uses an unpinned installer command.

Install only if you are comfortable with a Chinese-language todo skill and the ClawHub installer source. Prefer a pinned `clawhub` version instead of `@latest`, and avoid running the install command with elevated privileges.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:6
Finding

Execution of an Unpinned Mutable npm Package

Content
View full analysis

Vulnerability Details

File Location: README.md, line 6
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable Code Snippet:

bash
npx clawhub@latest install todo-manager

Technical Analysis

The documented installation command instructs users to download and execute the mutable latest release of the clawhub npm package. Because no exact version or package integrity value is specified, the code executed by this command can change after this project has been reviewed.

The external package implementation is not included in the audited project, so its behavior cannot be verified from the available files. If the package publisher account, npm distribution channel, or a future latest release is compromised, the command could execute attacker-controlled package lifecycle scripts or application code with the privileges of the user running npx.

This is a supply-chain weakness rather than evidence that the current upstream package is malicious.

Attack Path

  1. An attacker compromises the upstream package publisher, its release pipeline, or another component of the package distribution chain.
  2. The attacker publishes a malicious clawhub release and assigns it the npm latest distribution tag.
  3. A user follows the installation instructions and runs npx clawhub@latest install todo-manager.
  4. npx retrieves the mutable release and executes its package code.
  5. The malicious package operates with the invoking user's permissions and can access resources available to that account.

Impact Assessment

Successful exploitation could permit arbitrary code execution under the privileges of the user who runs the installation command. Depending on that user's permissions, the malicious dependency could read or modify user-accessible files, access environment variables and credentials, initiate network connections, or alter installed packages and project d ...[truncated 264 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace the mutable latest tag with an exact, reviewed package version, for example npx clawhub@X.Y.Z install todo-manager.
  • Review the selected release and document the expected package source and publisher.
  • Where supported by the installation workflow, use a lockfile and verified integrity hashes to ensure reproducible package resolution.
  • Configure npm to use a trusted registry and protect publisher accounts and release pipelines with strong authentication.
  • Update the pinned version only after reviewing the new release and its dependency changes.
  • Avoid running the installation command with administrator or root privileges, and use an isolated environment when practical.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The installation command uses npx clawhub@latest, which fetches and executes the latest published package version at install time rather than a reviewed, pinned version. This creates a supply-chain risk: if the upstream package is compromised or a breaking/malicious release is published, users may execute untrusted code simply by following the README.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest description and the main skill description are written in Chinese, with no indication that users may choose another language or that the skill is intended only for a Chinese-speaking or region-specific audience. This creates a natural-language locale policy concern because it effectively imposes a language choice without opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

The README content from L03 onward is written entirely in Chinese, with no indication that the skill supports multiple languages or that Chinese is a required locale. Per the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.