ClawHub
Back to skill

Security audit

Clawprobe

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent CLI observability helper, but users should verify the npm package before installing it globally.

Before installing, verify the clawprobe npm package and source repository, prefer a pinned reviewed version, and run it only where you are comfortable exposing local agent session telemetry, cost estimates, and compaction history to the monitoring process.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:14
Finding

Unpinned Global Installation of an Unaudited npm Package

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14–15
Vulnerability Type: Supply-chain risk from an unpinned third-party dependency
Risk Level: Medium

Vulnerable Code:

bash
npm install -g clawprobe
clawprobe start

Technical Analysis

The skill directs users or agents to globally install the latest available release of the third-party npm package clawprobe and immediately execute it. No exact version, lockfile, integrity hash, package provenance verification, or locally auditable implementation is provided.

Because npm packages can execute lifecycle scripts during installation, the installation itself may run code with the invoking user's permissions. The subsequent clawprobe start command executes additional implementation that is absent from the audited project. Resolving a mutable package version also means that the effective installed code can change after this skill has been reviewed.

The documented purpose of the package includes inspecting session health, token usage, API costs, context utilization, and compaction history. The local project does not contain enough implementation evidence to verify how that potentially sensitive information is collected, stored, or transmitted.

Attack Path

  1. A user or agent loads the skill and follows its installation instructions.
  2. npm resolves the current mutable release of the clawprobe package from the configured registry.
  3. If the package, maintainer account, publication process, or registry resolution has been compromised, attacker-controlled lifecycle scripts may execute during the global installation.
  4. The user invokes clawprobe start, executing further unaudited package code.
  5. The malicious code can access resources available to the invoking account and may inspect or transmit accessible agent/session data.

This is a supply-chain exposure rather than evidence that the current package is malicious.

Impact As

...[truncated 636 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin clawprobe to an exact, independently reviewed version rather than installing the latest release.
  2. Provide a lockfile and verify the package archive against a trusted integrity digest before installation.
  3. Reference immutable source code corresponding exactly to the distributed release and document its provenance.
  4. Prefer a project-local installation over npm install -g to reduce scope and make dependency resolution reproducible.
  5. Disable npm lifecycle scripts during installation where compatible, and separately review any required installation scripts before allowing them to run.
  6. Run the monitoring process under a dedicated least-privileged account or within an isolated environment.
  7. Restrict filesystem, credential, environment-variable, and outbound-network access to only what monitoring requires.
  8. Document what session information is collected, where it is stored, and whether it is transmitted externally.
  9. Establish dependency update review, package-signature or provenance verification, and automated supply-chain scanning before adopting later releases.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.