ClawHub
Back to skill

Security audit

inkwell

Security checks for vulnerabilities and agentic risk

Overview

This skill is purpose-aligned and clearly warns about publishing data, but users should install it cautiously because the working code is a pinned external Python package.

Install in a virtual environment, prefer the hash-checked requirements path, avoid root or administrator installs, use --no-embed-external for sensitive Markdown, and provide GitHub or WeChat credentials only when you intend to publish or upload content.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
requirements.txt:4
Finding
Runtime Behavior Delegated to an External Unaudited Package## Vulnerability Details **File Location**: `SKILL.md:14-16`, `SKILL.md:75-89`, `requirements.txt:4-5`, `SUPPLY_CHAIN.md:57-61` **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: Medium ### Vulnerable Code `SKILL.md:14-16`: ```yaml install: - kind: pip package: inkwell-press==0.8.1 bins: [inkwell] ``` `requirements.txt:4-5`: ```text inkwell-press==0.8.1 \ --hash=sha256:a4e7439a70b1804d84391749dd46a2e1af599f549d697f119c5a434bc2615165 ``` `SUPPLY_CHAIN.md:57-61`: ```markdown - [ ] Reproduce the wheel hash locally (Section 1) - [ ] Review `src/inkwell/` source at commit `d1842ba` - [ ] Generate a full transitive lock file (Section 2) - [ ] Confirm no post-install hooks in `pyproject.toml` - [ ] Confirm `Pillow` is imported only for image processing (`grep -r "from PIL" src/`) ``` ### Technical Analysis The audited project contains documentation and configuration but no implementation of the `inkwell` executable. All operational behavior is delegated to the externally distributed `inkwell-press==0.8.1` wheel. Pinning the package version and SHA-256 digest prevents silent substitution with a different wheel when installation uses `--require-hashes`. However, it does not demonstrate that the pinned wheel itself is safe or that it corresponds to the claimed source commit. The project's own supply-chain checklist identifies source review, wheel reproduction, post-install-hook inspection, and transitive dependency locking as incomplete verification tasks. Consequently, the package's actual file access, network behavior, credential handling, clipboard operations, and installation behavior cannot be verified from this artifact alone. ### Attack Path 1. A user or agent installs the Skill and retrieves `inkwell-press==0.8.1` from the Python package registry. 2. The package installer installs the pinned wheel and any unresolved runtime dependencies. 3. The user supplies ...[truncated 1016 chars]
Remediation
## Remediation Suggestions 1. Include the reviewed implementation source in the audited artifact or publish a verifiable source archive alongside the Skill. 2. Provide signed provenance linking the published wheel, source commit `d1842ba`, and build process. 3. Reproduce the wheel in a controlled build environment and document any expected sources of nondeterminism. 4. Make hash-enforced installation mandatory rather than presenting plain `pip3 install` as the primary path: ```bash python3 -m pip install --require-hashes -r requirements-lock.txt ``` 5. Commit a complete dependency lock file containing hashes for `inkwell-press`, Pillow, and every platform-specific artifact. 6. Review `pyproject.toml`, build-system dependencies, package entry points, and installation hooks before distribution. 7. Run the package in an isolated virtual environment or sandbox with minimum filesystem and network access. 8. Provide GitHub and WeChat credentials only for operations that require them, and use narrowly scoped, short-lived credentials where supported.

T08 · Insecure Dependencies

Warning
Location
PUBLISH.md:24
Finding
Publishing and Audit Procedures Execute Registry-Delivered Tools Without Pre-Established Integrity## Vulnerability Details **File Location**: `PUBLISH.md:24-25`, `PUBLISH.md:43-47`, `SUPPLY_CHAIN.md:38`, `SUPPLY_CHAIN.md:50-54` **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: Medium ### Vulnerable Code `PUBLISH.md:24-25`: ```bash # 1. 固定版本安装 ClawHub CLI（避免 rug pull 风险） npm install -g clawhub@0.23.3 ``` `PUBLISH.md:43-47`: ```bash npx clawhub@0.23.3 login npx clawhub@0.23.3 publish ./clawhub-publish/ --slug inkwell ... npx clawhub@0.23.3 inspect inkwell ``` `SUPPLY_CHAIN.md:38`: ```bash pip3 install pip-tools ``` `SUPPLY_CHAIN.md:50-54`: ```bash mkdir clawhub-audit && cd clawhub-audit npm init -y npm install clawhub@0.23.3 --save-exact # npm generates package-lock.json with integrity hashes cat package-lock.json | grep -A2 '"clawhub"' ``` ### Technical Analysis Exact version selection reduces version drift but does not provide pre-execution integrity verification for the complete dependency graph. The documented npm procedures download and execute registry-delivered packages before a trusted lockfile with reviewed integrity values has been established. The global `npm install -g` procedure increases the installation scope and may expose globally accessible command paths. The `npx` procedure can download and immediately execute a package. In addition, `pip-tools` is installed without an exact version or hash, even though it is subsequently trusted to generate the project's dependency lock file. Generating a lockfile after installation records what the registry supplied during that operation; it does not independently prove that those artifacts were trusted before execution. ### Attack Path 1. A maintainer follows the documented publishing or supply-chain audit procedure. 2. npm or pip contacts a public package registry and resolves the named package and its dependency graph. 3. Registry-delivered package code, command-line entry points, or npm lifecyc ...[truncated 987 chars]
Remediation
## Remediation Suggestions 1. Avoid global package installation and use a dedicated, unprivileged project directory or disposable container. 2. Commit a reviewed `package-lock.json` containing integrity values for `clawhub` and its complete dependency graph. 3. Install from the committed lockfile using: ```bash npm ci --ignore-scripts ``` Enable lifecycle scripts only if they are required and have been reviewed. 4. Prefer a previously verified local executable over `npx`, which can download and execute packages in one operation. 5. Pin `pip-tools` to an exact reviewed version and install it through a hash-locked requirements file: ```text pip-tools==<reviewed-version> --hash=sha256:<reviewed-digest> ``` 6. Verify registry provenance, signatures, and published checksums before executing downloaded tooling. 7. Run publishing tools with minimal credentials and remove unrelated secrets from the environment. 8. Use short-lived publishing sessions and inspect the final package contents before upload.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.