ClawHub
Back to skill

Security audit

Clawbridge Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed lead-scouting workflow that searches public sources and drafts outreach briefs, with privacy and delivery-channel cautions users should consider.

Before installing, treat this as a tool that collects and summarizes public personal or professional information. Configure narrow venues, budgets, and avoid lists; use private delivery targets only; do not auto-send outreach; and prefer pinned, verified installation sources where available.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:19
Finding
Unpinned Global Installation of Third-Party CLI and Skill## Vulnerability Details **File Location**: `SKILL.md`, lines 19-24 **Vulnerability Type**: Unverified and mutable third-party dependency installation **Risk Level**: Medium **Vulnerable Code**: ```bash # Install the ClawHub CLI npm install -g clawhub # Install this skill clawhub install claw-clawbridge ``` ### Technical Analysis The installation instructions retrieve and install the current registry versions of both the `clawhub` npm package and the `claw-clawbridge` Skill without version pins, integrity hashes, lockfiles, signature verification, or other provenance controls. Installing the npm package globally expands its potential effect to the user's environment. npm packages can define installation lifecycle scripts, so a compromised or malicious package release could execute code during installation with the privileges of the user running the command. The subsequent Skill installation is also mutable because no reviewed version or artifact digest is specified. This is a supply-chain risk rather than evidence that the currently documented packages are malicious. Exploitation depends on compromise, substitution, or publication of an unsafe release and on a user executing the documented commands. ### Attack Path 1. An attacker compromises the package publisher, registry account, distribution channel, or a future release of `clawhub` or `claw-clawbridge`. 2. The attacker publishes a malicious release under the expected package or Skill name. 3. A user follows the documentation and executes `npm install -g clawhub`. 4. npm retrieves the mutable latest release; malicious package content or applicable lifecycle scripts execute under the invoking user's account. 5. The compromised CLI may then alter the workspace or install attacker-controlled Skill content when `clawhub install claw-clawbridge` is executed. ### Impact Assessment Successful exploitation could allow arbitrary code execution with the privileges o ...[truncated 541 chars]
Remediation
## Remediation Suggestions - Pin the CLI and Skill to explicitly reviewed versions rather than installing mutable latest releases. - Publish and verify cryptographic integrity hashes or signed release artifacts through a documented trusted channel. - Provide the canonical package registry, publisher identity, and source repository so users can validate provenance. - Use a lockfile or a verified archive where supported. - Avoid global installation where possible; install the CLI in an isolated project or disposable environment with minimal privileges. - Disable npm lifecycle scripts during installation when they are not required, and document any scripts that are necessary. - Never instruct users to run installation commands as root or through `sudo`. - Re-audit each pinned release before updating the documented version and integrity value.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill is explicitly designed to search external profiles, communities, and the open web, then extract, rank, and draft outreach based on personal and professional signals. Without a clear privacy warning, users may not understand that the workflow involves collecting and processing personal data, creating compliance and trust risks around consent, data minimization, and lawful use.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The configuration shows that generated briefs may be delivered to Discord, Slack, or email, but the skill does not clearly warn users that enriched candidate data and outreach drafts could be sent to third-party destinations. This can lead to unintended disclosure of personal data or sensitive business intelligence outside the primary workspace, especially if those channels are shared, misconfigured, or externally hosted.

Static analysis

No suspicious patterns detected.