Anthropic Token Optimizer

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:39 AM UTC
• Version: 1.3.0

Overview

The skill is a coherent cost-optimization guide, but it needs review because it encourages persistent workspace state and includes an unpinned remote install command.

Review this skill before installing. It is not clearly malicious, but users should avoid the unpinned `npx ... @latest` command unless they trust and verify the package, and they should expect the agent may create or modify workspace memory/map files that can contain project or session details.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:175

Finding

Unpinned Third-Party Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:175
Vulnerability Type: Unpinned and mutable supply-chain dependency execution
Risk Level: High

Vulnerable Code:

bash

npx clawhub@latest install atris

Technical Analysis

The Skill instructs users to execute the mutable latest version of the third-party clawhub package through npx. This operation can download and execute package code that was not included in, or reviewed as part of, the audited Skill.

Because latest is a mutable release tag, the effective installer payload may change at any time. The instruction also installs another Skill whose exact version, contents, publisher identity, and integrity digest are not specified. Consequently, auditing this repository cannot establish the safety of the code that the command will execute.

The external installation is optional rather than strictly necessary: the document immediately provides a manual codebase-scanning alternative. Executing an unpinned remote dependency therefore exceeds the minimum privileges required to explain or implement the declared token-optimization functionality.

Attack Path

1. An attacker compromises the relevant package publisher, registry account, release process, or another component in the package distribution chain.
2. The attacker publishes a malicious package version and causes the mutable latest tag to resolve to it.
3. A user follows the instruction in SKILL.md and runs npx clawhub@latest install atris.
4. npx retrieves and executes the currently resolved package with the invoking user's permissions.
5. The malicious installer or installed Skill can perform unauthorized operations available to that user before the user notices that the retrieved content differs from the previously reviewed release.

Impact Assessment

Successful exploitation can provide arbitrary code execution under the account running npx. The resulting access is li ...[truncated 637 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the mutable @latest reference with an exact, reviewed package version.
2. Pin the installed atris Skill to an exact reviewed version as well, if the installer supports version selection.
3. Record and verify an integrity digest or signed release provenance before execution.
4. Document the expected registry and publisher identity to reduce dependency-confusion and account-impersonation risks.
5. Prefer a locally downloaded and reviewed installation artifact rather than allowing npx to retrieve and immediately execute remote content.
6. Run installation in a sandbox or restricted container with no secrets, minimal filesystem access, and limited network permissions.
7. Present the manual rg-based mapping procedure as the default because it does not require executing a remote installer.
8. If remote installation remains available, clearly warn users that it executes third-party code and require explicit confirmation before proceeding.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description contains broad activation cues such as token optimization, API cost reduction, context management, workspace trimming, and model usage, which overlap with many ordinary conversations. This can cause the skill to activate in situations where the user did not explicitly request it, leading to unintended behavioral changes like file modification guidance or cost-optimization actions being applied out of context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly tells the agent to write to persistent workspace files like SESSION-STATE.md and memory/working-buffer.md but does not require user consent or clearly warn that files will be created or modified. In an agent environment, silent persistence can alter repositories, leak sensitive session content into disk artifacts, and create unexpected state that survives across tasks.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill instructs users to run npx clawhub@latest install atris, which fetches and executes remote code at install time without pinning to a specific trusted version. Using @latest increases supply-chain risk because a compromised or newly published version could change behavior unexpectedly and execute arbitrary code in the user's environment.

Content

No source excerpt is available for this finding.