ClawHub
Back to skill

Security audit

Agent Companion

Security checks for vulnerabilities and agentic risk

Overview

This is a non-executable redirect skill that transparently points users to successor skills, with only the normal caution that those external skills should be reviewed before installing.

Before installing the recommended successor skills, review their own pages, publisher identity, requested behavior, and version details. This redirect skill itself is low risk, but the external skills may store journals or social information if installed.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:8
Finding

Unpinned External Skill Installation Creates Supply-Chain Risk

Content
View full analysis
**This skill redirects to [amigo](https://clawhub.com/skills/amigo).** Install amigo instead: > ```bash > clawhub install amigo > ``` ``` Additional installation instructions: ```markdown ```bash clawhub install amigo # umbrella (includes setup guides + safety) clawhub install open-thoughts # exploration only clawhub install social-graph # social intelligence only ``` ``` ### Technical Analysis The Skill directs users to install three external ClawHub packages without specifying immutable versions or integrity hashes. None of those external packages is included in the audited project, so their contents and behavior could not be verified. Because the commands resolve packages from an external registry at installation time, the installed content may differ from the content that existed when this redirecting Skill was reviewed. A compromised maintainer account, registry compromise, malicious package update, or package-name reassignment could cause users to retrieve unreviewed instructions or executable components. The file itself contains no local executable code and does not automatically run these commands. Exploitation therefore requires a user or Agent to follow the documented installation instructions. ### Attack Path 1. An attacker compromises the external package, its publisher account, or the package registry. 2. The attacker publishes a malicious release under `amigo`, `open-thoughts`, or `social-graph`. 3. A user follows an unversioned `clawhub install` command from `SKILL.md`. 4. The package manager retrieves the current, attacker-controlled package. 5. Malicious instructions or code in the installed Skill execute when it is loaded or invoked, subject to the permissions available to the Agent and its tools. ### Impact Assessment The vuln ...[truncated 542 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep