Security audit

system-info-skill

Security checks for vulnerabilities and agentic risk

Overview

The skill only reports basic local system information, with install-documentation caveats but no evidence of malicious runtime behavior.

Before installing, confirm the intended package name because SKILL.md says system-info-skill while README/package.json say system-info. Prefer a pinned or reviewed installer command in sensitive environments. Running the included Python script exposes basic machine details such as OS version, CPU count, memory, and disk usage in the terminal output.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:14
Finding: Unpinned Package Execution and Inconsistent Skill Identifiers
Content: View full analysis
Remediation: View remediation
install system-info ``` 2. Where supported, pin the Skill package to an exact immutable version or verified digest rather than installing the latest release. 3. Standardize the Skill identifier across all project files. Choose one canonical identifier, such as `system-info`, and update `SKILL.md`, `README.md`, and package metadata accordingly. 4. Document the expected registry and publisher identity so users can verify that package resolution uses a trusted source. 5. Publish checksums, signatures, or provenance attestations for distributed Skill artifacts and require verification before installation. 6. Recommend installation from a lockfile-backed or otherwise reproducible environment. In sensitive environments, download and inspect the CLI package before executing it rather than allowing `npx` to fetch and run an unreviewed current version. 7. Run installation with a non-administrative account and restrict CI tokens, filesystem permissions, and environment secrets available to the installation process. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 1)May include surrounding context.
md
--- name: system-info-skill description: Query system information including OS, CPU, memory, and disk usage. Use when users ask about system configuration, resource usage, performance diagnostics, or basic system info. Supports Windows, Linux, and macOS. ---

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: The README instructs users to run npx clawhub install system-info without pinning a specific version. This allows whatever version is current at execution time to be fetched and run, which creates a supply-chain risk if the package is compromised, updated maliciously, or unexpectedly changed. In a setup/install command, that risk is materially relevant because users are being told to execute it directly.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This code includes comments, CLI description, argument help text, and printed output entirely in Chinese, which imposes a specific language on users. The file does not offer any language selection or indicate that the skill is intentionally limited to a Chinese-speaking context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README presents the skill description entirely in Chinese, which implies a fixed language experience without any indication that users may choose another language. Under the policy rule, forcing a specific language without opt-in is a natural-language policy concern unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The package description is written only in Chinese, which imposes a specific language on users without any opt-in, alternative locale, or documented regional limitation. This is a natural-language policy issue because the skill metadata does not indicate that the skill is China-specific or provide multilingual support.
Content: No source excerpt is available for this finding.