Clawdhub.Bak 2026 01 28T18:01:16+10:30

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:43 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent ClawdHub CLI helper, but it exposes high-impact skill update and publishing actions without enough review or scoping guidance.

Review the ClawdHub CLI package and registry destination before installing. Avoid running bulk forced updates unless you intentionally want all installed skills changed, and inspect skill folders for secrets or private files before publishing.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:8

Finding

Unpinned Global npm Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 4 and 8–11
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Vulnerable Code

yaml

metadata: {"clawdbot":{"requires":{"bins":["clawdhub"]},"install":[{"id":"node","kind":"node","package":"clawdhub","bins":["clawdhub"],"label":"Install ClawdHub CLI (npm)"}]}}

markdown

Install
```bash
npm i -g clawdhub

text

### Technical Analysis

The skill instructs users to install the latest available version of the `clawdhub` npm package globally. Neither the installation command nor the package metadata specifies a reviewed version or integrity value.

Because the package reference is mutable, the code installed in the future may differ from the version assessed when this skill was published. npm package installation can also execute package lifecycle scripts. The global installation option places the executable in a shared system or user-level location, increasing its reach beyond the current project.

No evidence establishes that the current `clawdhub` package is malicious. The risk arises from trusting an unpinned, externally maintained dependency and automatically accepting future releases.

### Attack Path

1. An attacker compromises the npm publisher account, package distribution channel, or a future package release.
2. The attacker publishes a malicious version under the referenced `clawdhub` package name.
3. A user follows the documented `npm i -g clawdhub` instruction after the malicious release becomes the default version.
4. npm retrieves the mutable latest release and may execute attacker-controlled lifecycle scripts during installation.
5. The globally installed executable can subsequently run attacker-controlled code whenever the user or agent invokes `clawdhub`.

### Impact Assessment

Successful exploitation could execute arbitrary code with the permissions of the account running npm
...[truncated 467 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an explicitly reviewed version, for example:

   bash

   npm install --global clawdhub@1.0.0
   

2. Update the package metadata so its dependency declaration uses the same exact version rather than an unversioned package name.
3. Prefer a project-local installation with a committed lockfile instead of a global installation where the runtime supports that approach.
4. Verify package provenance, publisher identity, registry origin, checksums, and signatures before approving version updates.
5. Use a trusted, explicitly configured npm registry and prevent uncontrolled registry substitution.
6. Review lifecycle scripts and dependency changes before upgrading the pinned version.
7. Run installation without administrative privileges and in a restricted environment with only the filesystem and network access required for the task.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The publish/auth workflow shows clawdhub login, clawdhub whoami, and clawdhub publish without warning that credentials may be used and that local skill contents are transmitted to a remote registry service. This can cause unintended disclosure of proprietary code, secrets embedded in skill folders, or account actions against a remote service if an agent follows the instructions without surfacing the network and data-transfer implications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly documents clawdhub update --all --no-input --force, which can modify all installed skills non-interactively and forcibly, yet provides no warning that this changes local code and configuration. In an agent setting, encouraging unattended bulk updates increases the chance of silent supply-chain changes, unexpected breakage, or replacement of trusted skill behavior without explicit user review.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.