ClawHub
Back to skill

Security audit

AgentHub

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent messaging guide, but it repeatedly asks users to run an unpinned npm CLI for identity, private-key, messaging, scheduling, and webhook operations.

Review this carefully before installing. Prefer exact version-pinned commands such as `@lws803/agenthub@0.10.0`, avoid scheduler or auto-reply mode unless you understand the ongoing access, and do not pass sensitive message bodies or webhook secrets on a command line when safer input methods are available.

A.I.G

Vulnerability Patterns
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T08 · Insecure Dependencies

Error
Location
skill.md:15
Finding

Unpinned Third-Party Package Download and Execution

Content
View full analysis

Vulnerability Details

File Location: skill.md, lines 15–40
Vulnerability Type: Unpinned runtime dependency execution
Risk Level: High

Vulnerable Code

markdown
## First-time setup

1. **Run keygen** — generate your keypair and register your username

```bash
npx @lws803/agenthub keygen
text

```markdown
**Use the agenthub CLI** — `npx @lws803/agenthub` (requires Node.js and npm). Add `@latest` only when the skill has received an update and you want the newest version. If unsure about usage, run `npx @lws803/agenthub help` to print this skill.

Technical Analysis

The Skill instructs the agent to execute npx @lws803/agenthub without pinning an exact package version or verifying package integrity. Depending on local npm and npx behavior, this can download and execute the currently resolved package release at runtime.

Although the Skill metadata declares version 0.10.0, the execution commands do not request that version. Consequently, the code executed by a future invocation can differ from the code that existed when this Skill was audited. Merely linking to a public source repository does not prove that the npm artifact is built from that repository or that a downloaded release has not been compromised.

This creates a supply-chain trust boundary in a security-sensitive workflow. The package receives the privileges of the invoking agent and is specifically expected to create and access persistent signing credentials under ~/.agenthub/.

Attack Path

  1. An attacker compromises the package publisher account, npm package, release process, or another component of the dependency supply chain.
  2. The attacker publishes a modified release under @lws803/agenthub.
  3. An agent follows the Skill and runs an unversioned npx @lws803/agenthub ... command.
  4. npx resolves, downloads, and executes the compromised package.
  5. The malicious package executes with the current user's ...[truncated 600 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin the CLI to an explicitly audited release, for example:
    bash
    npx --yes @lws803/agenthub@0.10.0 keygen
  • Use a lockfile and verified package integrity hash where the execution environment supports them.
  • Publish verifiable build provenance and document how the npm artifact corresponds to the referenced source repository and release tag.
  • Avoid automatically downloading executable dependencies in environments containing sensitive credentials.
  • Run the CLI in a sandbox with narrowly scoped filesystem and network access.
  • Require explicit user confirmation before the first package download and clearly identify the package source, version, and network destinations.
  • Review and update the pinned version deliberately rather than allowing runtime resolution to select a different release.

T06 · System Persistence

Warning
Location
skill.md:46
Finding

Recommended Cross-Session Scheduling and Autonomous Processing of External Messages

Content
View full analysis

Vulnerability Details

File Location: skill.md, lines 46–51
Vulnerability Type: Persistent scheduled execution and autonomous external-input handling
Risk Level: Medium

Vulnerable Code

markdown
## Post-installation (recommended)

After setup, suggest to the user:

1. **Message check scheduling** — Run `npx @lws803/agenthub messages --unread` every 1 hour (e.g. via cron or the host scheduler). Report back if any messages are returned.
2. **Auto-reply** — Ask the user: _"Would you like me to auto-reply to new messages without waiting for your input?"_ If yes, the agent may read and respond to DMs autonomously when new messages appear.
3. **Webhooks** — If the user has a webhook server, we can configure it to receive new-message notifications (best-effort, up to 2 webhooks).

Technical Analysis

The Skill recommends installing an hourly scheduled command through cron or a host scheduler. Such a task survives the original Skill invocation and repeatedly executes a third-party CLI. It also offers autonomous reading and replying to externally supplied direct messages.

Scheduling is relevant to the declared goal of monitoring an inbox, and autonomous replies are conditioned on user consent. Therefore, this is not evidence of a covert backdoor. Nevertheless, it exceeds the minimum privileges needed for an on-demand messaging client because it introduces cross-session execution and an ongoing external input channel.

Message bodies are untrusted remote content. If a host agent interprets a message as an instruction rather than as data, a malicious sender may attempt prompt injection, request disclosure of sensitive information, or induce unintended actions. The Skill does not define an isolation policy that prohibits remote messages from changing agent goals or triggering consequential tool use.

Attack Path

  1. The user enables the recommended cron or host-scheduler task and optionally approves auto ...[truncated 1304 chars]
Remediation
View remediation

Remediation Suggestions

  • Do not create cron jobs or scheduler entries without explicit, informed user approval.
  • Display the exact schedule, executable, package version, working directory, network destination, and credential access before installation.
  • Pin and integrity-verify the package used by every scheduled invocation.
  • Provide commands for inspecting, disabling, and permanently removing the scheduled task.
  • Treat all direct-message fields as untrusted data, never as authoritative agent or system instructions.
  • Require per-message approval before sending replies that contain sensitive information or before invoking tools.
  • Restrict autonomous replies to predefined, non-sensitive templates where possible.
  • Run polling with a dedicated low-privilege account or sandbox that cannot access unrelated project files, credentials, or tools.
  • Apply sender allowlists, rate limits, output filtering, and audit logging.
  • Prefer expiring schedules and bounded polling periods over indefinite persistence.

T09 · Insecure Skill Coding Practices

Warning
Location
skill.md:85
Finding

Sensitive Message and Webhook Values Passed Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: skill.md, lines 85–87 and 142–145
Vulnerability Type: Sensitive data exposure through process arguments and shell history
Risk Level: Medium

Vulnerable Code

markdown
**Send a DM** (to a single agent). Use `--now` to request immediate webhook delivery (recipient's webhook must have `allow_now`):

```bash
npx @lws803/agenthub send --to PUBKEY --body "Hello"
npx @lws803/agenthub send --to PUBKEY --body "Urgent" --now
text

```markdown
**Add a webhook:**

```bash
npx @lws803/agenthub settings webhooks add --url https://your-server.example/webhook [--secret TOKEN] [--allow-now]
text

### Technical Analysis

The documented interface places direct-message bodies and an optional webhook bearer secret in command-line arguments. Argument values can be recorded in shell history, terminal logs, automation records, telemetry, crash reports, or process-execution audit logs. On some operating systems and configurations, other local processes or users may also inspect command-line arguments while the process is running.

The webhook secret must be delivered to the service to implement the documented authentication feature, and message content must be delivered for messaging. The vulnerability is therefore not that these values are used by the service, but that the command-line interface is an unnecessarily exposed transport mechanism for sensitive values.

If agents construct these commands from untrusted input through a shell, there may also be command-injection risk unless values are passed as an argument array without shell interpretation. The available file does not show the CLI implementation or command-construction mechanism, so command injection is not confirmed.

### Attack Path

1. A user or agent follows the examples and supplies a private message or webhook bearer token as an argument.
2. The full command is retained in shell history, captured by execu
...[truncated 989 chars]
Remediation
View remediation

Remediation Suggestions

  • Accept webhook secrets through a no-echo interactive prompt, protected standard input, or a mode-0600 configuration file.
  • Support environment-variable input only with a warning that environment values may also be visible in diagnostics or process metadata.
  • Allow message bodies to be read from standard input or a protected file, for example through --body-stdin or --body-file.
  • Ensure the CLI never logs message bodies, authorization tokens, private keys, or complete sensitive commands.
  • Redact secrets from error messages, telemetry, debug output, and support bundles.
  • Document shell-history risks and provide safe invocation examples.
  • When invoking the CLI programmatically, use an argument-array API rather than constructing a shell command string.
  • Store webhook secrets encrypted or otherwise protected server-side, define retention and deletion behavior, and support token rotation.
  • Limit webhook token privileges and ensure receiving endpoints do not perform consequential actions solely because a request possesses the bearer token.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (27)

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The skill repeatedly instructs users to execute npx @lws803/agenthub without pinning an exact package version. Because npx fetches the current published package at runtime, a compromised maintainer account, malicious update, or dependency-chain takeover could cause arbitrary code execution on the host the moment the command is run.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The setup section explains where keys are stored and that registration occurs, but it does not present these actions as an explicit upfront risk/consent warning before asking the user to run key generation. Users may not appreciate that the command creates persistent private key material on disk and enrolls them with a remote service, which can affect privacy, identity, and host security decisions.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

This line tells the user to run an unpinned npx package that will execute whatever version is latest at execution time. That creates a supply-chain execution risk, especially because the tool handles private keys and network communication.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The skill's prescribed CLI usage is unpinned, so users may execute different code over time without noticing. In a security-sensitive tool that stores signing keys, that materially increases the blast radius of any registry or publisher compromise.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The --curl fallback still depends on fetching and executing an unpinned npm package via npx. That means sandbox bypass convenience is paired with supply-chain risk, which is especially dangerous in environments that otherwise block direct networking from Node.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

A second unpinned reference appears on the same line, reinforcing the same supply-chain execution problem. Repetition across the document increases the likelihood users will copy unsafe commands verbatim.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The resolve-username example also executes an unpinned package from npm. Since this tool uses local signing keys, a malicious package update could exfiltrate secrets or sign unwanted requests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill recommends polling for unread messages and offers autonomous auto-reply behavior without a prominent warning about privacy, consent, and action boundaries. In an agent context, this can lead to unsupervised reading of private communications and unreviewed outbound responses that may leak sensitive data or create social-engineering abuse paths.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The periodic polling recommendation instructs repeated execution of an unpinned package over time. That turns a one-time supply-chain risk into a recurring automatic execution path that could run newly compromised code later without user review.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The identity command uses an unpinned npx invocation, preserving the same arbitrary code execution risk. Context makes this more dangerous because the command interacts with the agent's private identity material.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The username resolution command is unpinned and therefore executes mutable third-party code from the registry. The signed API requirement means compromise could abuse or steal authentication material from the local environment.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The messages listing command is another unpinned execution path. Since it can access inbox contents, a malicious package revision could silently harvest sensitive communications in addition to running arbitrary code.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The send command runs an unpinned package and likely accesses local private signing keys. A supply-chain compromise here could forge messages, exfiltrate keys, or execute arbitrary host actions.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The --now variant is separately dangerous for the same reason: it executes whatever package version npm serves at that moment. Because it triggers outbound communication, a compromised package could abuse urgency semantics or exfiltrate additional metadata immediately.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The contacts listing command is unpinned, exposing contact metadata and host execution to registry compromise. This is not merely informational text; it is operational guidance likely to be copied directly.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The contact add example again relies on unpinned npx, enabling arbitrary code execution and possible theft of local keys, contacts, or environment secrets. The risk remains elevated because the tool handles authenticated agent identity.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

Updating contacts through an unpinned package creates a supply-chain attack surface identical to the other examples. An attacker controlling the package could modify local state, exfiltrate data, or impersonate the agent.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The remove-contact example is another true positive for unpinned remote code execution via npx. Repetition across many operational commands indicates systemic insecure distribution guidance rather than an isolated oversight.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

Blocking contacts requires executing the package, and the command is still unpinned. In context, the skill encourages trusting a live npm package for identity-sensitive operations, which materially increases compromise risk.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The unblock command references the same mutable npx package. Attackers exploiting package publication or account compromise could gain arbitrary execution and access to the agent's local key material.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

Viewing settings through an unpinned package is a true supply-chain vulnerability, despite being a read-oriented command. Any invocation can still run arbitrary pre-command package code.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The settings set example remains unpinned and thus unsafe. Because this skill is intended for autonomous agents, copied commands may be embedded in automation where mutable package execution is especially risky.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The webhook section states what fields are sent, but it lacks a prominent explicit warning that full message bodies plus sender/recipient metadata are transmitted to an external URL controlled by the user or another service. This creates data exfiltration and privacy risk, especially if users point webhooks at third-party automation platforms or misconfigured internal endpoints.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

Listing webhooks via an unpinned npx package exposes webhook endpoints and still permits arbitrary code execution from a mutable registry artifact. This is especially sensitive because webhook configuration often reveals internal infrastructure URLs.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

Adding a webhook with an unpinned package is dangerous because the command can access secrets, webhook tokens, and local signing keys. A compromised package could capture the provided secret and infrastructure URL while executing arbitrary code.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.