ClawHub
Back to skill

Security audit

Content Monetization

Security checks for vulnerabilities and agentic risk

Overview

This is a small advisory skill for content monetization, with no embedded code or hidden behavior; the main caution is its unpinned npx install command.

Install only if you are comfortable running the ClawHub installer from npm; a pinned installer version would be stronger. The skill itself is advice-focused, so review monetization suggestions before acting on them, especially for affiliate links, paid products, or platform policy compliance.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:14
Finding

Execution of an Unpinned npm Package During Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 14
Vulnerability Type: Supply-chain risk caused by mutable dependency execution
Risk Level: Medium

Complete Code Snippet:

bash
npx clawhub@latest install content-monetization

Technical Analysis

The documented installation command uses npx to download and execute the package referenced by the mutable latest tag. Because no exact package version or integrity hash is specified, the code executed during installation can change after this Skill has been reviewed.

An attacker who compromises the clawhub package, its publisher account, or the relevant registry metadata could cause latest to resolve to a malicious release. Following the documented command would then download and execute that release, including applicable CLI and package lifecycle behavior, with the permissions of the invoking user.

Attack Path

  1. An attacker compromises the npm package, its publisher credentials, or the package distribution process.
  2. The attacker publishes a malicious version and assigns or causes the latest tag to point to it.
  3. A user follows the installation instructions in SKILL.md.
  4. npx resolves clawhub@latest, downloads the attacker-controlled package version, and executes its CLI.
  5. The malicious process performs actions available to the invoking account.

Impact Assessment

Successful exploitation could provide code execution with the privileges of the user running the installation command. Depending on that user's permissions and environment, the malicious package could read or modify accessible files, access environment variables and locally available credentials, tamper with the project or user configuration, and initiate network connections. The affected scope is the installation environment and resources accessible to the invoking account. The audited file does not itself demonstrate privilege escalation, persistence, or ...[truncated 28 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace @latest with an exact, reviewed package version, for example clawhub@X.Y.Z.
  • Verify the selected release's provenance, publisher identity, and source repository before recommending it.
  • Pin and validate the package artifact using an integrity digest or an equivalent trusted verification mechanism.
  • Use a trusted registry explicitly and prevent unexpected registry substitution through controlled npm configuration.
  • Review package lifecycle scripts and CLI entry points before execution.
  • Run installation with least privilege in an isolated environment, without unnecessary credentials or sensitive environment variables.
  • Establish a controlled update process in which newer versions are reviewed before the pinned version is changed.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The installation command uses npx clawhub@latest, which fetches and executes the newest published package version at runtime rather than a reviewed, fixed version. This creates a supply-chain risk: if the package is compromised or a breaking/malicious update is published later, users installing the skill could execute untrusted code.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The activation condition 當用戶話「我想靠內容賺錢」既時候 is broad and does not define clear boundaries on what the skill may do or when it should defer. Overly broad triggers can cause the skill to activate in unintended contexts, increasing the chance of irrelevant, policy-conflicting, or user-unexpected behavior, though this file does not contain high-risk actions beyond advice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill instructions and examples are presented in Cantonese/Chinese, which implicitly enforces a language choice for users. There is no indication that users can choose another language or that this locale restriction is intentional and justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.