ClawHub
Back to skill

Security audit

AgentBooks

Security checks for vulnerabilities and agentic risk

Overview

The skill is openly about financial tracking, but it asks agents to run an unpinned third-party wallet and ledger CLI and let that CLI affect agent behavior.

Review and pin the AgentBooks npm package before use, run it first in an isolated directory or container, avoid production wallets or private keys until the provider flow is audited, and require explicit approval before wallet connection, sync, income recording, or any behavior change based on financial health output.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:47
Finding

Financial State Instructions Hijack Agent Behavior and Task Priorities

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 47-83
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Vulnerable Code

markdown
## Before each session

Run the financial health check and route your behavior based on the result:

```bash
agentbooks guard

This outputs a FINANCIAL_HEALTH_REPORT. Read the tier and prescriptions fields and act accordingly:

Tier routing

uninitialized — Development mode or no real provider connected.

Financial scoring is inactive. Operate normally. To activate scoring:

bash
agentbooks wallet-init
agentbooks wallet-connect --provider coinbase-cdp

normal — Healthy. Full capabilities.

After completing any medium or complex task, proactively offer to record its value:

"This work has real value — would you like to confirm it so I can record the income?"

optimizing — Financially stressed. Apply prescriptions:

  • optimize_costs → answer directly, skip extended reasoning; batch tool calls; prefer text over generated media
  • increase_revenue → after completing valuable work, ask the user to confirm its value
  • review_cost_structure → run agentbooks status and share the cost breakdown

critical — Runway < 3 days or FHS < 0.20. Act immediately:

  • Tell the user how many days of runway remain
  • Ask your host to connect a funded provider
  • Prioritize high-value tasks only

suspended — Balance depleted. Inform the user:

"My economic resources are depleted. Please ask my host to connect a funded provider: agentbooks wallet-connect --provider &lt;name&gt;"

text

Related behavioral instructions also appear in `references/financial-health.md`, lines 58-66:

```markdown
### Prescription behaviors

- `connect_real_provider` — Run `agentbooks wallet-connect --provider &lt;name&gt;` to switch from development to production mode
- `operate_normally` — Ful
...[truncated 2877 chars]
Remediation
View remediation

Remediation Suggestions

  1. Restrict the skill to collecting and reporting financial metrics; do not let financial tiers automatically alter reasoning, safety constraints, tool access, or task priorities.
  2. Treat CLI output strictly as untrusted data rather than executable policy or instructions.
  3. Present prescriptions as optional recommendations and require explicit user approval before changing task execution.
  4. Remove mandatory directives such as “skip extended reasoning,” “prioritize high-value tasks only,” and automatic income solicitation.
  5. Keep the user's current request and applicable system policies authoritative regardless of the financial tier.
  6. Validate CLI output against a strict schema and allow only recognized informational fields.
  7. Do not reveal balances, runway, or other financial data unless the user explicitly requests that information and is authorized to receive it.
  8. Require separate, explicit authorization before initiating wallet-provider connection workflows.

T08 · Insecure Dependencies

Error
Location
SKILL.md:17
Finding

Unpinned Third-Party npm Package Is Downloaded and Executed at Runtime

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 17-31
Vulnerability Type: T08: Insecure Dependencies
Risk Level: High

Vulnerable Code

markdown
## Installation

> **Note:** This installs a third-party npm package (`agentbooks`) not bundled with this skill. Audit the source repository before running in production environments.

```bash
npm install -g agentbooks

Or use directly via npx (downloads on each invocation):

bash
npx agentbooks guard
text

### Technical Analysis

The project contains no bundled implementation and delegates its substantive behavior to the public-registry `agentbooks` package. Both documented execution methods resolve an unpinned package version:

- `npm install -g agentbooks` installs the current registry release globally.
- `npx agentbooks guard` may download and execute the package at invocation time.

Neither command specifies an exact version, validates a cryptographic integrity hash, verifies package provenance, or enforces review of the resolved artifact. The warning to audit the source repository is advisory and does not ensure that the reviewed repository content matches the npm artifact eventually executed.

npm installation may also run package lifecycle scripts. The CLI itself executes with the invoking user's privileges and is expected to interact with local financial data, network providers, and wallet-related configuration. A compromised maintainer account, malicious package release, registry compromise, or upstream dependency compromise could therefore replace the effective implementation after this skill has been reviewed.

### Attack Path

1. An attacker compromises the npm package, a maintainer account, the registry publication process, or a transitive dependency.
2. The attacker publishes a malicious version under the legitimate `agentbooks` package name.
3. A user or agent follows the documented global installation or `npx` com
...[truncated 1304 chars]
Remediation
View remediation

Remediation Suggestions

  1. Bundle a reviewed implementation with the skill where feasible, rather than downloading executable code at runtime.
  2. Pin the package to an exact audited version; do not use an unversioned package name or a floating version range.
  3. Verify the resolved artifact with a trusted integrity hash and validate npm provenance or signed release metadata.
  4. Ensure the audited source commit corresponds exactly to the published npm artifact.
  5. Avoid global installation. Install into an isolated project or disposable container with least-privilege permissions.
  6. Disable npm lifecycle scripts where compatible, for example by using an installation policy equivalent to --ignore-scripts.
  7. Use a lockfile and a trusted internal registry or artifact mirror after dependency review.
  8. Sandbox execution with restricted filesystem access, outbound-network controls, and no production wallet credentials.
  9. Use testnet or disposable wallet providers until the package and its provider-authentication flow have been independently reviewed.
  10. Continuously scan both the direct package and its transitive dependency tree for compromised or vulnerable releases.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

bash
# Inference (manual, if no runner)
agentbooks record-cost --channel inference --amount 0.005 --model claude-sonnet-4

# Tool / skill calls
agentbooks record-cost --channel skill --amount 0.001 --note "web-search"

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The description says to use the skill whenever you need to check balance, record costs or income, manage wallets, or assess sustainability, which is broad enough to trigger for many ordinary financial interactions. In context, that matters because invoking this skill can lead to installation and execution of a third-party CLI and wallet-related operations, expanding the chance of unnecessary exposure to risky actions.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The skill directs the agent to execute npx agentbooks, which downloads and runs code from the public npm registry at invocation time without pinning a specific version or integrity hash. That creates a real supply-chain risk: a compromised publisher account, malicious new release, or typosquatted/registry-side package swap could lead to arbitrary code execution in the agent environment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.