Clawbridge Skill

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 8:09 AM UTC
• Version: 0.1.0

Overview

This skill is a disclosed lead-scouting workflow that searches public sources and drafts outreach briefs, with privacy and delivery-channel cautions users should consider.

Before installing, treat this as a tool that collects and summarizes public personal or professional information. Configure narrow venues, budgets, and avoid lists; use private delivery targets only; do not auto-send outreach; and prefer pinned, verified installation sources where available.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:19

Finding

Unpinned Global Installation of Third-Party CLI and Skill

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 19-24
Vulnerability Type: Unverified and mutable third-party dependency installation
Risk Level: Medium

Vulnerable Code:

bash

# Install the ClawHub CLI
npm install -g clawhub

# Install this skill
clawhub install claw-clawbridge

Technical Analysis

The installation instructions retrieve and install the current registry versions of both the clawhub npm package and the claw-clawbridge Skill without version pins, integrity hashes, lockfiles, signature verification, or other provenance controls.

Installing the npm package globally expands its potential effect to the user's environment. npm packages can define installation lifecycle scripts, so a compromised or malicious package release could execute code during installation with the privileges of the user running the command. The subsequent Skill installation is also mutable because no reviewed version or artifact digest is specified.

This is a supply-chain risk rather than evidence that the currently documented packages are malicious. Exploitation depends on compromise, substitution, or publication of an unsafe release and on a user executing the documented commands.

Attack Path

1. An attacker compromises the package publisher, registry account, distribution channel, or a future release of clawhub or claw-clawbridge.
2. The attacker publishes a malicious release under the expected package or Skill name.
3. A user follows the documentation and executes npm install -g clawhub.
4. npm retrieves the mutable latest release; malicious package content or applicable lifecycle scripts execute under the invoking user's account.
5. The compromised CLI may then alter the workspace or install attacker-controlled Skill content when clawhub install claw-clawbridge is executed.

Impact Assessment

Successful exploitation could allow arbitrary code execution with the privileges o ...[truncated 541 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the CLI and Skill to explicitly reviewed versions rather than installing mutable latest releases.
• Publish and verify cryptographic integrity hashes or signed release artifacts through a documented trusted channel.
• Provide the canonical package registry, publisher identity, and source repository so users can validate provenance.
• Use a lockfile or a verified archive where supported.
• Avoid global installation where possible; install the CLI in an isolated project or disposable environment with minimal privileges.
• Disable npm lifecycle scripts during installation when they are not required, and document any scripts that are necessary.
• Never instruct users to run installation commands as root or through sudo.
• Re-audit each pinned release before updating the documented version and integrity value.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is explicitly designed to search external profiles, communities, and the open web, then extract, rank, and draft outreach based on personal and professional signals. Without a clear privacy warning, users may not understand that the workflow involves collecting and processing personal data, creating compliance and trust risks around consent, data minimization, and lawful use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The configuration shows that generated briefs may be delivered to Discord, Slack, or email, but the skill does not clearly warn users that enriched candidate data and outreach drafts could be sent to third-party destinations. This can lead to unintended disclosure of personal data or sensitive business intelligence outside the primary workspace, especially if those channels are shared, misconfigured, or externally hosted.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.