Ai Agent Setup

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:00 PM UTC
• Version: 1.0.0

Overview

This is a short consulting-style AI agent setup skill with no bundled code or hidden behavior, though users should treat deployment advice and the unpinned install command cautiously.

Before installing, verify the ClawHub package source and consider using a pinned reviewed version instead of @latest. Treat any real customer-platform deployment as a separate action requiring explicit approval, scoped credentials, and environment checks.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12

Finding

Unpinned Third-Party Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12-14
Vulnerability Type: Unpinned executable dependency
Risk Level: Medium

bash

npx clawhub@latest install ai-agent-setup

Technical Analysis

The installation instructions invoke clawhub through npx using the mutable latest tag. If the package is not already available locally, npx may download and execute the version currently published under that tag. The project does not specify an audited version, integrity hash, lockfile, or trusted package provenance.

Because latest can point to different package contents after this skill has been reviewed, the command creates a supply-chain risk. Compromise of the package publisher, registry account, release process, or package distribution channel could cause users to execute altered code without any corresponding change to this repository.

Attack Path

1. An attacker compromises the clawhub package publisher, release pipeline, registry account, or another relevant distribution component.
2. The attacker publishes a malicious release and assigns it to the latest tag.
3. A user follows the documented installation command.
4. npx retrieves and executes the attacker-controlled package version.
5. The malicious package executes with the permissions of the user running the command and may modify files, access user-readable information, invoke network services, or install additional components.

Impact Assessment

Successful exploitation can provide arbitrary code execution under the invoking user's account. The accessible scope includes files, credentials, environment variables, network resources, and applications available to that account. If the command is run from a privileged administrative or CI/CD context, the impact may expand to system-wide resources, deployment credentials, build artifacts, or connected infrastructure. The reviewed file does not itself demonstrate privilege es ...[truncated 66 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the mutable latest tag with an exact, reviewed package version, for example npx clawhub@X.Y.Z.
• Verify that the package comes from the intended registry and publisher before execution.
• Use registry-supported integrity verification or a documented cryptographic checksum where available.
• Review the pinned package, including lifecycle scripts and transitive dependencies, before recommending it.
• Execute installation with a non-privileged account in an isolated environment.
• In automated environments, enforce dependency allowlists, lockfiles, and reproducible installation controls.
• Establish a controlled process for reviewing and explicitly approving upgrades rather than tracking latest automatically.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill explicitly mentions deploying agents to customer platforms but provides no warning, guardrail, or confirmation requirement for system-impacting actions. In context, this increases risk because deployment can affect real customer environments, credentials, integrations, and production workflows if the skill is invoked inappropriately or followed too literally.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The installation command uses npx clawhub@latest, which pulls the latest published package rather than a pinned, reviewed version. This creates a supply-chain risk: a compromised or malicious future release could be executed by users during installation with no version stability or trust boundary.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger condition "當用戶話『整AI Agent』既時候" is broad and can overlap with ordinary conversation about building agents, causing unintended activation. In a skill that discusses consulting, design, quoting, and deployment, accidental invocation could lead the agent to take or propose actions outside the user's precise intent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.