Skill Update Litiao

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 3:57 AM UTC
• Version: 1.0.0

Overview

This is a disclosed skill-updater with preview, confirmation, backup, and rollback guidance, though users should be careful about the unpinned npx ClawHub commands.

Install only if you want an agent to help manage skill updates. Before following its commands, prefer a pinned or trusted preinstalled ClawHub CLI, review the preview diff, confirm backups were created, and approve updates or migrations only when you understand the changed files and impact.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:35

Finding

Unpinned ClawHub CLI Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:35-36 and preview.md:7
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable Code

SKILL.md:35-36:

bash

npx clawhub outdated           # List skills with updates
npx clawhub info <slug>        # Show available versions

preview.md:7:

bash

npx clawhub fetch <slug>@<version> --dir /tmp/preview-<slug>

Technical Analysis

The documented commands execute clawhub through npx without pinning the CLI package to a specific, reviewed version. If the package is not already available locally, npx may retrieve it from the configured package registry and execute it immediately.

Although the fetch command supplies a version for the skill being downloaded, that version does not constrain the version or integrity of the clawhub executable itself. The effective CLI implementation can therefore change after this skill has been reviewed.

This creates a supply-chain trust boundary in which compromise of the registry account, package distribution infrastructure, package name resolution, or a newly published malicious CLI version could result in arbitrary code execution.

Attack Path

1. An attacker compromises the package publisher, registry distribution path, or another component controlling the package resolved as clawhub.
2. The attacker publishes or serves a malicious version containing install-time or runtime code.
3. A user or Agent follows the skill instructions and runs one of the unpinned npx clawhub commands.
4. npx resolves and downloads the attacker-controlled package when no trusted local version is available.
5. Package lifecycle logic or the invoked CLI executes with the permissions of the current user or Agent process.
6. The malicious package can access resources available to that process before optionally displaying expected CLI output to conceal t ...[truncated 627 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the ClawHub CLI to an exact, audited version rather than relying on the registry's current version:

   bash

   npx --yes clawhub@<verified-version> outdated
   npx --yes clawhub@<verified-version> info <slug>
   npx --yes clawhub@<verified-version> fetch <slug>@<version> --dir /tmp/preview-<slug>
   

2. Prefer a trusted, preinstalled CLI managed through a lockfile containing package integrity hashes.
3. Configure an approved package registry and verify package provenance, signatures, and integrity before installation or execution.
4. Where supported, install the reviewed package in advance and execute it in offline mode so npx cannot silently retrieve a newer implementation.
5. Review dependency trees and package lifecycle scripts before approving a new CLI version.
6. Run update tooling with least privilege and restrict its filesystem, credential, and network access to the minimum required.
7. Update both SKILL.md and preview.md so every example follows the same pinned and verified execution procedure.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

This skill is explicitly designed to update skills, which is a form of self-modification of agent capabilities and instructions. Even though the document includes safety steps like preview, backup, and confirmation, self-update functionality remains high risk because it can alter future behavior, introduce malicious or incompatible instructions, and expand the impact of any compromised source or mistaken approval.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: skill-update-litiao
description: "Safely update skills with preview, migration support, and user validation. Never lose data or break workflows."
---

## Safe Skill Updates

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The skill instructs use of npx clawhub without pinning a specific package version, which can cause execution of whatever version is currently resolved from the registry. In a self-update workflow, that increases supply-chain risk because behavior may change unexpectedly or a compromised upstream release could be fetched at execution time.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The npx clawhub info <slug> command also relies on an unpinned package resolution path, meaning the update-checking logic may run different code over time without user awareness. Because this skill is about modifying installed skills, using mutable tooling adds avoidable supply-chain and integrity risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The instruction to check for updates whenever the user 'mentions a skill' is overly broad and may trigger update-related behavior during ordinary discussion rather than a clear maintenance request. In a skill that can lead to self-modification, unsolicited update checks can expand the action surface and nudge users toward risky operations they did not intend to start.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The command uses npx clawhub without pinning a specific package version, so execution may resolve to whatever version is currently published or otherwise available at runtime. In a skill-update workflow, this increases supply-chain risk because a compromised or unexpected package version could be fetched and executed during preview, affecting the local environment or producing misleading update data.

Content

No source excerpt is available for this finding.