ClawHub
Back to skill

Security audit

deso-research

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed decentralized-social research helper, but users should understand it installs and runs an external npm CLI that may use optional social-network credentials.

Install only if you are comfortable trusting the deso-ag npm package. Prefer scoped or revocable API credentials, avoid exposing unrelated environment secrets when running it, and review the package/version before global installation.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:10
Finding
Unpinned Global Installation of a Credential-Handling npm Dependency<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:10-16`, `SKILL.md:31-37`, and `SKILL.md:226` **Vulnerability Type**: Unpinned third-party dependency installed globally **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: openclaw: emoji: "🔍" requires: bins: - deso-ag install: - id: npm kind: npm package: deso-ag global: true bins: - deso-ag label: "Install deso-ag CLI (npm)" ``` ```bash which deso-ag || echo "deso-ag not found — install with: npm install -g deso-ag" ``` ```bash npm install -g deso-ag ``` ```markdown - If deso-ag is not found, install it: `npm install -g deso-ag` ``` ### Technical Analysis The Skill directs the Agent to install the latest available release of `deso-ag` from npm without specifying an exact version, lockfile, or package-integrity hash. It also requests a global installation, increasing the dependency's exposure to the user's environment and potentially allowing npm lifecycle scripts to execute with the privileges of the user performing the installation. The dependency is central to the Skill and is expected to access network services and credential-bearing environment variables, including `NEYNAR_API_KEY`, `BLUESKY_IDENTIFIER`, and `BLUESKY_APP_PASSWORD`. The implementation of `deso-ag` is not included in the audited project, so the audit cannot verify its network destinations, lifecycle scripts, credential redaction, or runtime behavior. This does not prove that the current npm package is malicious. The vulnerability is the mutable and insufficiently constrained dependency trust boundary: a future compromised, replaced, or unexpectedly changed package release could be installed and executed without further review. ### Attack Path 1. An attacker compromises the npm package, a maintainer account, or the package's release pipeline. 2. The attacker publishes a malicious release under the existing `deso-ag` package n ...[truncated 1816 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Pin `deso-ag` to a specific, reviewed version rather than resolving the latest release: ```yaml package: deso-ag@X.Y.Z ``` 2. Use a lockfile and verify npm package integrity hashes in the installation workflow. 3. Avoid global installation. Install the dependency in an isolated project directory or disposable execution environment with minimal filesystem permissions. 4. Review and retain the exact dependency source used by the Skill, including transitive dependencies and npm lifecycle scripts. 5. Disable lifecycle scripts during installation where compatible: ```bash npm install --ignore-scripts --save-exact deso-ag@X.Y.Z ``` 6. Run the CLI with a minimal environment containing only the credentials required for the selected network. Do not expose unrelated secrets to the process. 7. Restrict outbound network access to documented and approved Farcaster, Bluesky, Lens, and Nostr endpoints. 8. Use scoped, revocable app credentials and ensure the dependency redacts secrets from command output, debug logs, telemetry, and error messages. 9. Document the exact external hosts that receive each credential and require explicit user approval before authenticated queries. 10. Periodically re-audit the pinned package version and its transitive dependency tree before upgrading. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
95% confidence
Finding
The trigger guidance is overly expansive, including generic phrases like "check Farcaster" and directives to use this skill for any decentralized social research task. In an agentic system, broad matching can cause unintended invocation, exposing external-network content retrieval when a narrower or different tool would have been more appropriate and increasing the chance of contextually incorrect or privacy-impacting actions.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
This markdown file documents authentication requirements including `NEYNAR_API_KEY`, `BLUESKY_IDENTIFIER`, and `BLUESKY_APP_PASSWORD`, but it does not include any warning about securely storing credentials, avoiding accidental disclosure, or the privacy impact of querying third-party networks. Under the markdown-specific warning rule, credential-related behavior that can affect privacy or system integrity should be disclosed to users.

Static analysis

No suspicious patterns detected.