Data Automation Service

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:00 PM UTC
• Version: 1.0.0

Overview

The skill’s stated data-automation purpose is coherent, but its install command runs a mutable latest npm package without pinning or integrity checks.

Review the install path before using this skill. Prefer a pinned, reviewed `clawhub` version or an official trusted installation method, and avoid running the install command in a privileged shell or sensitive environment. The skill content itself is a simple data-automation consultation workflow, but the mutable install command should be treated with caution.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12

Finding

Unpinned npm Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 12
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code:

bash

npx clawhub@latest install data-automation-service

Technical Analysis

The documented installation command directs npx to retrieve and execute the latest release of the clawhub npm package. Because the dependency is not pinned to a reviewed version and no integrity value is specified, the code executed by this command can change after the Skill has been audited.

npx can download a package and execute its CLI code with the permissions of the invoking user. Package lifecycle behavior or CLI implementation in a compromised or unexpectedly modified future release could therefore execute arbitrary local commands. The file does not establish that the package is currently malicious; the finding concerns the unsafe and mutable supply-chain trust model.

Attack Path

1. An attacker compromises the npm package, its publisher account, or its release process, or causes a malicious release to become the version identified by latest.
2. A user follows the installation instruction in SKILL.md.
3. npx resolves and downloads the attacker-controlled release.
4. The downloaded package's CLI or applicable lifecycle behavior executes under the user's account.
5. The malicious release can perform actions permitted to that account, such as reading accessible files, modifying user-owned data, accessing available environment variables, or initiating network connections.

Impact Assessment

Successful exploitation could obtain arbitrary code execution with the privileges of the user running the command. The affected scope includes files, credentials, environment variables, network resources, and application data accessible to that user. If the command is run from a privileged account or in a broadly authorized CI environment, the impact could e ...[truncated 204 chars]

Remediation

View remediation

Remediation Suggestions

• Replace @latest with an exact, reviewed package version.
• Verify that the package name and publisher correspond to the official distribution source.
• Record and verify the package integrity hash where the installation workflow permits it.
• Review the package contents, CLI entry point, and lifecycle scripts before execution.
• Use a lockfile or other reproducible dependency mechanism rather than resolving a mutable release tag.
• Run installation with a non-privileged account in an isolated environment with only the filesystem, credential, and network access required for installation.
• Establish a controlled update process in which newer versions are separately reviewed before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill description and examples are entirely written in Chinese/Cantonese, and the usage pattern assumes interaction in that language without stating that users may choose another language. This creates a natural-language locale constraint that is not presented as optional or justified as region-specific.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The installation command uses npx clawhub@latest, which fetches and executes the latest published package version at install time rather than a reviewed, fixed version. This creates a supply-chain risk: if the package is compromised or a malicious update is published, users may execute attacker-controlled code simply by following the skill's instructions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger phrase 整數據自動化 is broad and overlaps with ordinary user requests for help with data automation, so the skill may activate unintentionally in contexts where the user did not explicitly request this specific skill. Unintended activation can cause the agent to follow this skill's workflow, shaping responses, collecting unnecessary business details, or steering the interaction toward quoting and implementation plans without clear user consent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.