Ai Writing Assistant

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:18 AM UTC
• Version: 1.0.0

Overview

This is a simple AI writing helper with a documented network requirement and no hidden code, persistence, credential access, or destructive behavior.

Before installing, consider pinning or verifying the ClawHub installer version instead of using `@latest`, and avoid sending confidential drafts unless you are comfortable with the skill's network-based AI processing.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:5

Finding

Mutable npm Package Is Downloaded and Executed During Installation

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 5–7
Vulnerability Type: Unpinned executable dependency
Risk Level: Medium

bash

npx clawhub@latest install ai-writing-assistant

Technical Analysis

The documented installation command instructs npx to retrieve and execute the npm package associated with the mutable latest distribution tag. Because this tag can point to a different package version at any time, the code users execute may differ from the version that was reviewed.

The downloaded clawhub implementation is not included in this project, so its lifecycle scripts, transitive dependencies, integrity, and runtime behavior cannot be verified from the audited artifact. If the npm package, publisher account, release pipeline, or dependency chain is compromised, following the documented installation procedure could execute attacker-controlled code.

Attack Path

1. An attacker compromises the clawhub npm publisher account, release pipeline, package, or one of its executable dependencies.
2. The attacker publishes a malicious release and assigns it to the latest distribution tag.
3. A user follows the installation command in README.md.
4. npx retrieves the release currently referenced by latest.
5. Package lifecycle scripts or CLI initialization code execute under the invoking user's account.
6. Malicious code can access resources available to that account and potentially modify the local environment or installed skill content.

Impact Assessment

Successful exploitation would provide code execution with the privileges of the user running the installation command. Depending on that user's permissions and environment, the attacker could read or alter user-accessible files, access environment variables and credentials, modify installed packages, or execute additional processes.

The affected scope is the installation environment. The artifact itself contains no evidence of privilege escalation, persiste ...[truncated 141 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace @latest with an exact, reviewed package version, for example:

   bash

   npx clawhub@X.Y.Z install ai-writing-assistant
   

2. Verify the selected release and its transitive dependencies before recommending it to users.
3. Pin and validate package integrity using an approved lockfile, checksum, signature, or equivalent reproducible verification mechanism.
4. Document the expected npm registry and package publisher to reduce registry substitution and package-spoofing risks.
5. Prefer an installation workflow that separates package download and inspection from execution.
6. Advise users not to run the installer with elevated privileges and to use an isolated environment where practical.
7. Update the pinned version only after security review rather than automatically tracking a mutable distribution tag.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence

Finding

The install command uses npx clawhub@latest, which pulls and executes the latest published package version at install time rather than a pinned, reviewed version. If the upstream package is compromised, typosquatted, or a malicious update is published, users could execute attacker-controlled code during installation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README presents the skill description entirely in Chinese except for isolated command examples, which can amount to forcing a specific language for user-facing interaction. The policy allows language constraints only when the skill offers opt-in choice or clearly documents and justifies the locale restriction, neither of which is present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The description and tags present the skill exclusively in Chinese, which may indicate a language-specific experience without any stated user opt-in or locale choice. Under the language/locale policy rule, this can be a natural-language policy concern unless the metadata explicitly documents that the skill is intended only for Chinese-speaking users or offers language selection.

Content

No source excerpt is available for this finding.