Safety Programming Checklist

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:02 AM UTC
• Version: 1.0.3

Overview

This is a disclosed safety checklist skill with minor publishing-workflow cautions, not code that runs or hides behavior.

Before following the publishing reference, verify the ClawHub CLI source, consider pinning a known version, and review the skill directory for secrets or unintended files. The checklist itself is appropriate for cautious system-level code work and does not show hidden execution or data exfiltration.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/clawhub-publish.md:6

Finding

Unpinned Global npm Package Installation

Content

View full analysis

Vulnerability Details

File Location: references/clawhub-publish.md, lines 6–8
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Vulnerable Code:

bash

npm install -g clawhub

Technical Analysis

The documented command installs the latest available version of the clawhub npm package globally. It does not pin a reviewed version or provide a lockfile, integrity hash, signature-verification procedure, or other mechanism for validating the downloaded artifact.

Because npm packages can run lifecycle scripts during installation, a compromised or unexpectedly modified package release could execute code with the privileges of the user running the command. The global installation scope also makes the resulting executable available beyond this individual workflow and may replace an existing version of the CLI.

Attack Path

1. An attacker compromises the npm package, its publisher account, or the package distribution process.
2. The attacker publishes a malicious release under the package name referenced by the documentation.
3. A user follows the documented prerequisite and runs npm install -g clawhub.
4. npm retrieves the latest release without enforcing a previously reviewed version or expected integrity value.
5. Malicious installation lifecycle scripts execute with the invoking user's privileges, or the installed global CLI later executes attacker-controlled behavior.
6. The compromised executable remains globally available to subsequent commands until it is removed or replaced.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the privileges of the invoking user. This may allow access to that user's files, environment variables, authentication material available to the process, and ClawHub-related session data. It could also modify user-writable files or install a compromised CLI that affects later workflows. ...[truncated 262 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the CLI to a reviewed release, for example clawhub@<approved-version>, rather than implicitly installing the latest version.
2. Verify that the package name, npm publisher, repository, and release provenance match the official ClawHub distribution channel.
3. Record and validate an expected package integrity hash or use a lockfile-backed, reproducible installation process.
4. Prefer a project-local dependency over a global installation, and invoke it through a controlled script or package runner that enforces the approved version.
5. Where available, use an officially signed standalone release and verify its signature or checksum before execution.
6. Review package lifecycle scripts before installation and consider disabling them with --ignore-scripts when they are not required.
7. Run the installation under a non-administrative account with least privilege and avoid exposing unrelated credentials or sensitive environment variables to the installation process.
8. Establish a controlled upgrade process in which new versions are reviewed and tested before the pinned version is changed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file instructs the user to run a publish command against a local directory, which implies sending local skill contents to a remote service. The document gives procedural steps but does not include any user-facing warning about reviewing the directory contents or confirming that no sensitive data is included before publication.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.