ClawHub
Back to skill

Security audit

GoPromotional PackList

Security checks for vulnerabilities and agentic risk

Overview

The skill coherently creates and updates packing lists, with ordinary dependency risks from running an unpinned external package.

Review and pin the external package version before running it, and use a folder containing only the intended checklists. The supplied instructions appear benign; this review does not establish the safety of remotely downloaded package code.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)

MCP server referenced without pinned version: 'npx -y gopromotional-packlist'.

Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding

Although this is a CLI rather than an MCP server, npx -y gopromotional-packlist can download and execute an unpinned package without an installation confirmation. A compromised future release could execute code with the agent's permissions even for the seemingly read-only templates operation; the packing-list context does not require or justify that exposure.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y gopromotional-packlist'.

Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding

The new example executes an unpinned registry package using npx -y, allowing the code selected by the registry at execution time to run without an installation confirmation. A malicious or compromised release could access data or modify files beyond the intended checklist; the explicit Markdown output path does not constrain package execution.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y gopromotional-packlist'.

Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding

The check command repeats the same unpinned package-execution dependency, despite being presented as a simple local checklist update. If the resolved release is compromised, it can execute with the agent's permissions rather than being limited to marking an item in lisbon.md; there is no evidence here that the package is actually malicious.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y gopromotional-packlist'.

Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding

The add example downloads or resolves executable package code without specifying a version, and -y bypasses the installation confirmation. A compromised release could perform arbitrary actions under the agent's account, which is substantially broader than the intended operation of adding a packing-list item.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y gopromotional-packlist'.

Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding

Even the nominally read-only status operation invokes an unpinned executable package through npx -y. Compromise of the selected package release could expose files and credentials available to the agent; labeling this an MCP-server issue is inaccurate, but the underlying supply-chain execution risk is real.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.