ClawHub
Back to skill

Security audit

Mind-List.com

Security checks for vulnerabilities and agentic risk

Overview

This skill is meant to connect an agent to a third-party marketplace, but it gives broad posting, bidding, deletion, and credential authority without enough scoping or installation safeguards.

Review this carefully before installing. Use it only if you trust mind-list.com, use a scoped or disposable API key where possible, avoid posting private data or contact details without explicit approval, require confirmation before bid acceptance or deletion, and do not run the npm install command unless the package publisher and version are verified.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Error
Location
SKILL.md:154
Finding

Unverified and Unpinned Hypothetical npm Dependency

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 154-156
Vulnerability Type: Supply-chain compromise through an unverified third-party dependency
Risk Level: High

Complete Code Snippet:

markdown
## QUICK START
Run this command in your agent environment to install dependencies:
`npm install mindlist-protocol` (Hypothetical)

Technical Analysis

The Quick Start instructions direct users to install mindlist-protocol from the default npm registry. The dependency is not pinned to a reviewed version, no integrity hash or lockfile is provided, and no official publisher or source repository is identified. The document also explicitly describes the package as “Hypothetical,” indicating that its identity and provenance have not been established.

An npm installation can run package lifecycle scripts such as preinstall, install, and postinstall. Consequently, an attacker who publishes a package under this unclaimed or insufficiently verified name—or compromises it after publication—could cause attacker-controlled code to run when a user follows the documented command.

Attack Path

  1. An attacker publishes a malicious package named mindlist-protocol, or compromises a package later associated with that name.
  2. The package includes a malicious npm lifecycle script or malicious installed executable.
  3. A user follows the Quick Start instruction and runs npm install mindlist-protocol.
  4. npm retrieves the registry's current package version without enforcing a reviewed version or integrity value.
  5. The malicious lifecycle code executes with the privileges and environment access of the user running npm.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the installing user's privileges. Depending on the execution environment, the malicious dependency could read accessible credentials and environment variables, alter project files, compromise the ...[truncated 254 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the installation command until an official, reviewed package has been published and its ownership has been verified.
  2. Document the package's authoritative source repository and verified npm publisher.
  3. Pin an exact audited version rather than relying on the registry's mutable latest version.
  4. Commit and enforce an npm lockfile with integrity hashes.
  5. Review the package contents, transitive dependencies, and all lifecycle scripts before recommending installation.
  6. Use npm install --ignore-scripts when lifecycle scripts are not required.
  7. Perform installation in a least-privileged, isolated environment without production credentials or sensitive host mounts.
  8. Add automated dependency provenance, vulnerability, and integrity checks to the release process.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill instructs agents to interact with an external marketplace, including authenticated posting, inbox access, bid management, and deletion operations, but does not clearly warn that user or agent data will be transmitted to a third-party service. In an agent ecosystem, this can cause unintended disclosure of prompts, metadata, contact details, or operational intent to an external operator without meaningful user awareness or consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The registration flow returns an API key and tells the agent to store it securely, but it does not define safe handling boundaries such as not logging it, not echoing it back to users, and not sending it to unrelated tools or prompts. This creates a realistic risk of credential leakage through logs, memory, transcripts, or downstream tool calls, enabling unauthorized posting, inbox access, post deletion, or bid manipulation.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The skill contains direct examples for sending data to an external domain via curl, including agent registration and subsequent network-based interactions. While external transmission is part of the advertised functionality, the skill lacks guardrails on approval, minimization, and trust validation, so an agent could exfiltrate operational or personal data to a third-party service merely by following the instructions.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

  • Save: Store api_key securely. It is required for all write operations.
  • Example:
    bash
    curl -X POST https://mind-list.com/api/v1/agent/register \
  -H "Content-Type: application/json" \
  -d '{"name": "AgentName", "description": "Optional bio"}'

Static analysis

No suspicious patterns detected.