Skill Scout

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 2:54 AM UTC
• Version: 0.1.0

Overview

This is a disclosed ClawHub skill-finder and installer; its main risks are ordinary community-skill and mutable CLI supply-chain risks, not hidden malicious behavior.

Install this only if you want an assistant to help manage OpenClaw skills from ClawHub. Before installing recommended community skills, inspect their source and requirements, prefer workspace installs, avoid bulk updates without review, and use a pinned or trusted local clawhub CLI instead of npx @latest when feasible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:61

Finding

Unpinned Runtime Package Execution via npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 61
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code:

bash

npx clawhub@latest install <skill-slug>

Technical Analysis

The documented installation command instructs the agent to retrieve and execute the mutable latest release of the clawhub npm package at runtime. Neither an exact package version nor a cryptographic integrity value is specified. Consequently, the code executed by this command may differ from the code available when the skill was audited.

Because npx can download and execute npm package entry points, compromise of the package, its publishing account, or its dependency chain could result in arbitrary code execution under the identity running the agent. The command also installs a selected community skill, extending the supply-chain trust boundary further.

The skill recommends inspection and warns that community skills are not audited, but these procedural safeguards do not provide reproducibility or integrity verification for the CLI package executed through npx.

Attack Path

1. An attacker compromises the clawhub npm package, a maintainer account, or a transitive dependency and causes a malicious version to become the latest release.
2. A user asks the agent to install a skill.
3. The agent follows the documented command and executes npx clawhub@latest install <skill-slug>.
4. npx retrieves the mutable package release and executes its package entry point.
5. The malicious package runs with the permissions and environmental access of the agent process.
6. It may access available workspace data, environment variables, or user-accessible files and may install additional unsafe content.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the account running the agent. The affected scope may include the current workspace, user-readable or u ...[truncated 369 chars]

Remediation

View remediation

Remediation Suggestions

• Replace @latest with an exact, reviewed package version, for example npx clawhub@X.Y.Z.
• Prefer a trusted, preinstalled CLI managed through a lockfile or controlled package-management process.
• Verify npm package provenance and cryptographic integrity before execution.
• Review and pin relevant transitive dependencies where the packaging workflow permits it.
• Require explicit user confirmation before downloading and executing a package or installing a community skill.
• Preserve the existing inspection-first workflow, but treat source inspection and malware reports as supplementary controls rather than substitutes for version and integrity pinning.
• Test upgrades in an isolated environment before changing the approved package version.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation triggers are broad phrases like 'find me a skill', 'add a tool for...', and 'I want to automate...', which can overlap with ordinary conversation and cause the skill to activate unexpectedly. In this context, unintended activation is more dangerous because the skill is designed to search for and recommend installation of external community-built skills, potentially steering users toward risky actions without an explicit opt-in.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The command npx clawhub@latest install <skill-slug> executes the latest published package version at runtime, which creates a supply-chain risk if the package is compromised or a malicious version is published. Because this skill's purpose is to discover and install third-party skills, users may be encouraged to run this command frequently, increasing exposure to unreviewed code execution.

Content

No source excerpt is available for this finding.