ClawHub
Back to skill

Security audit

Startup Agent (→ raon-os)

Security checks for vulnerabilities and agentic risk

Overview

This is a transparent alias skill that tells users to install the separate raon-os skill, with no bundled code or hidden behavior in this package.

Before installing, confirm that raon-os is the package you intend to use and that you trust its publisher and current version. This alias package itself is minimal and disclosed, but the main package will determine the real capabilities and permissions.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:8
Finding

Unpinned External Skill Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 8-12
Vulnerability Type: Unpinned third-party Skill dependency
Risk Level: Medium

Vulnerable Code

markdown
## Installation

```bash
clawhub install raon-os
text

### Technical Analysis

The documented installation command resolves the external `raon-os` Skill by a mutable package name without specifying an audited version, immutable commit, or integrity digest. The referenced Skill is not included in this repository, so its implementation and effective behavior could not be examined during this audit.

Consequently, the content installed by this command may change after this alias package has been reviewed. Compromise of the referenced package, its publisher account, or the package registry could cause users following these trusted instructions to receive unauthorized content.

The local `package.json` contains no dependencies or lifecycle scripts, and this repository contains no executable code. The risk arises specifically from directing users to install an unaudited, unpinned external component.

### Attack Path

1. An attacker compromises the publisher account, distribution channel, or mutable release of the external `raon-os` Skill.
2. The attacker publishes a modified release under the same package name.
3. A user follows the documented `clawhub install raon-os` command.
4. ClawHub resolves the mutable name to the attacker-modified release.
5. The malicious Skill receives whatever execution capabilities and permissions the user or Skill runtime grants when it is loaded or invoked.

This path depends on compromise or malicious modification of the external package or its distribution infrastructure; no such compromise is demonstrated by the audited files.

### Impact Assessment

Successful exploitation could allow attacker-controlled Skill instructions or code to run within the permissions granted to the installed Skill. Potential scope includes access to data, tools, creden
...[truncated 221 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace the mutable installation command with an explicitly pinned, security-reviewed version of raon-os.
  2. Prefer an immutable package digest or equivalent integrity identifier where ClawHub supports one.
  3. Publish and verify cryptographic checksums or signatures for the referenced package.
  4. Document the expected publisher identity and a procedure for verifying package provenance before installation.
  5. Re-audit the external Skill whenever the pinned version is updated.
  6. Where practical, vendor the reviewed dependency into the distribution so the installed implementation matches the audited content.
  7. Apply least-privilege permissions when installing and running the external Skill.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

The description states the skill is an "AI-powered startup companion for Korean founders," which imposes a locale-specific target audience in natural language without indicating user choice or opt-in. This can be interpreted as a language/locale policy constraint because the file does not clarify that the regional focus is optional or user-selectable.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.