Upwork Automation Gig

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:57 PM UTC
• Version: 1.0.0

Overview

This skill is purpose-aligned but needs review because it can automatically apply to jobs and send marketplace outreach without clear confirmation controls.

Review this skill carefully before installing. Use it only if you are comfortable with an agent drafting marketplace proposals, and require explicit confirmation before it applies to jobs or sends messages. Prefer a pinned installer version and clarify where lead-tracking data will be stored.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13

Finding

Unpinned Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 13
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable code snippet:

bash

npx clawhub@latest install upwork-automation-gig

Technical Analysis

The installation instructions invoke the mutable latest release of the third-party clawhub package through npx. If the requested package is not already available locally, npx can retrieve it from the configured package registry and execute its CLI code under the current user's account.

Because latest is a mutable distribution tag, the code executed by this command can change after the skill has been reviewed. The project does not provide an exact dependency version, package integrity hash, lockfile, vendored source, or other mechanism for verifying the code that will be executed. The implementation of both the retrieved CLI and the installed skill is outside the audited project, which contains only SKILL.md.

This finding does not establish that the current clawhub package is malicious. The vulnerability is the trust placed in mutable, externally supplied executable content without version or integrity controls.

Attack Path

1. An attacker compromises the package publisher, registry account, release process, or another relevant supply-chain component.
2. The attacker publishes a malicious release and assigns it to the latest distribution tag.
3. A user follows the documented installation command.
4. npx resolves and downloads the attacker-controlled release from the configured registry.
5. The package CLI or applicable lifecycle behavior executes with the privileges and environment of the invoking user.
6. The malicious release can access resources available to that user, subject to operating-system and sandbox restrictions.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the privileges of the user runnin ...[truncated 515 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the mutable latest tag with an exact, reviewed package version, for example clawhub@X.Y.Z.
2. Verify the package artifact against a trusted integrity digest or signed provenance before execution.
3. Document the expected registry and reject unexpected registry overrides or mirrors.
4. Review the resolved package, transitive dependencies, lifecycle scripts, and CLI entry point before approving an upgrade.
5. Run installation in a sandbox or least-privileged environment without unnecessary credentials, sensitive environment variables, or access to unrelated files.
6. Establish an explicit update process so new versions are reviewed and pinned rather than adopted automatically through a mutable tag.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill describes automated searching, proposal generation, application submission, and outreach on third-party platforms, but it does not warn users that it may act on their accounts or send messages externally. In this context, the omission is significant because the skill can affect reputation, violate platform policies, create spam, or trigger unauthorized communications at scale.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The entire skill description and examples are written in Cantonese/Chinese with no indication that users may choose another language or locale. This can violate language-choice policy when the skill implicitly assumes a fixed language without user opt-in.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The install command uses npx clawhub@latest, which pulls and executes the latest published package version at runtime rather than a reviewed, pinned release. This creates a supply-chain risk: if the package is compromised or behavior changes, users may execute untrusted code when installing the skill.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrase is overly broad: when a user says '搵job', the skill is instructed to automatically search marketplaces and generate proposals/apply actions. Ambiguous activation is dangerous here because it can cause external-account activity and outbound communications without sufficiently explicit user consent for each step.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.