Advisor Board Pro

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:19 AM UTC
• Version: 1.0.0

Overview

The skill appears aimed at enterprise decision support, but its install path and handling of shared or migrated business records need review before use.

Review this skill before installing in a business environment. Pin or verify the installer version, avoid running it with elevated privileges, and confirm where consultation history, exported reports, team comments, and migrated records are stored and who can access them.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: .

Finding

Mutable Package Version Executed Through npx

Content

View full analysis

Vulnerability Details

File Location: README.md:43, SKILL.md:127, and SKILL.md:185
Vulnerability Type: Unsafe execution of an unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

README.md:43:

bash

npx clawhub@latest install advisor-board-pro

SKILL.md:127:

bash

npx clawhub@latest install advisor-board-pro

SKILL.md:185:

bash

npx clawhub@latest install advisor-board-pro

Technical Analysis

The documented installation procedure uses npx to retrieve and execute the mutable latest release of the third-party clawhub package. The project does not pin an audited package version, provide an integrity hash, identify a verified source repository, or include a lockfile that would make the executed dependency reproducible.

Because the latest tag can be reassigned whenever a new package version is published, the effective code executed by users can change after this project has been reviewed. The two documentation files contain no implementation of the advertised skill, so the security properties of the installation and resulting skill depend entirely on externally retrieved package content that is outside the audited artifact.

This is a supply-chain exposure rather than evidence that the current external package is malicious. Exploitation requires compromise or malicious control of the package publication channel, publisher account, registry resolution, or a subsequently published release.

Attack Path

1. An attacker compromises the package publisher account or another relevant part of the package distribution chain.
2. The attacker publishes a malicious clawhub release and assigns it to the latest tag.
3. A user follows the installation instructions and runs npx clawhub@latest install advisor-board-pro.
4. npx resolves and retrieves the attacker-controlled release.
5. The malicious package code or lifecycle behavior executes ...[truncated 839 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the mutable latest tag with an exact, reviewed package version, for example:

   bash

   npx clawhub@1.2.3 install advisor-board-pro
   

2. Verify the selected release before recommending it, including its package contents, lifecycle scripts, maintainer identity, and dependency tree.
3. Publish and verify package integrity metadata or cryptographic signatures where supported.
4. Document the official registry and source repository so users can confirm the package's provenance.
5. Use lockfiles and reproducible installation procedures for any maintained implementation.
6. Avoid running the installation command with administrator or root privileges.
7. Consider installing the reviewed package without immediately executing it, inspecting its contents first, and then invoking a locally pinned binary.
8. Add an automated dependency-review process that detects publisher changes, unexpected lifecycle scripts, integrity changes, and newly introduced transitive dependencies.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (8)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The entire README, including the example invocation, is written only in Chinese and does not indicate that other languages are supported or that Chinese is a deliberate region-specific limitation. This can violate language/locale policy when a skill imposes a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file advertises report export capabilities for enterprise decision materials, which may include confidential company information. The description presents the feature as a benefit but does not warn users about handling, storage, or sharing risks associated with exported files.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The README instructs users to run npx clawhub@latest install advisor-board-pro, which pulls and executes the latest published package version at install time without pinning a specific trusted release. This creates a supply-chain risk: if the upstream package is compromised or a malicious version is published, users may execute attacker-controlled code during installation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill content and usage examples are almost entirely in Chinese, and the metadata includes a 'chinese' tag, but the description does not clearly state that the skill is Chinese-only or offer an opt-in language/locale choice. This can violate language/locale policy when a skill implicitly constrains users to a specific language without clear disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill advertises report export, multi-user collaboration, comments, decision tracking, and shared history, but does not warn that sensitive business, investment, or strategic data may be retained, exposed to collaborators, or included in exported files. In this enterprise decision-making context, the omitted disclosure is more dangerous because the content is likely to include confidential company information.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The installation command uses npx clawhub@latest, which fetches and executes the latest package version at runtime instead of a reviewed, fixed version. This creates a supply-chain risk: if the package is compromised or updated maliciously, users may execute attacker-controlled code simply by following the documented install step.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The upgrade instructions again use npx clawhub@latest, which causes execution of whatever version is current at the time the user runs the command. Repeating this pattern in upgrade guidance increases exposure to package compromise, typosquatting, or malicious upstream changes during normal maintenance workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Automatic migration of prior consultation records is described without any notice that historical data will be transferred to the Pro version. This can move sensitive prior analyses into a different service tier or storage context without informed user consent, increasing confidentiality and compliance risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.