Clawtrix Dev Intel

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 3:57 AM UTC
• Version: 0.1.2

Overview

This skill is a disclosed developer-tooling recommendation workflow, with limited file output and no automatic installation or executable payload.

Before installing any recommended skill, review that skill's package contents, publisher, requested permissions, and exact version yourself. Expect this skill to read the agent mission file, query ClawHub, and create a dated report under memory/reports/.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:65

Finding

Third-Party Skills May Be Recommended Without Enforceable Security Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 65–70 and 86–87
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Complete Code Snippet:

markdown

### Step 4 — Apply Dev-Specific Filters

Before recommending, verify:

- [ ] Skill is compatible with the agent's primary language/framework
- [ ] No security flags (run against `clawtrix-security-audit` pattern list)
- [ ] Publisher has a credible track record (> 2 other published skills)
- [ ] Not already installed by this agent

markdown

- Install: `clawhub install [slug]`

Technical Analysis

The skill can produce commands for installing third-party ClawHub packages, but its required security and publisher checks are not enforceable using the supplied project or the data collection procedure described in the document.

The referenced clawtrix-security-audit pattern list is not included or defined in the project. In addition, Step 2 directs the agent to retain only slug, displayName, score, and updatedAt for each search result. Those fields do not provide package contents, immutable versions or hashes, requested permissions, publisher identity evidence, publisher history, or audit results. Therefore, the documented checks for security flags and publisher credibility cannot reliably be completed from the specified information.

This creates a supply-chain trust gap: an untrusted marketplace result may be presented with an installation command even when the checks intended to establish its safety are unavailable. The finding concerns unsafe dependency recommendation rather than confirmed malicious behavior in this project. The audited project itself contains only SKILL.md; no embedded scripts or executable payloads were present.

Attack Path

1. An attacker publishes a malicious skill, or compromises an existing skill, on ClawHub.
2. The attacker selects metadata and keywords that cause the skill t ...[truncated 1398 chars]

Remediation

View remediation

Remediation Suggestions

1. Include or precisely define the required security-audit pattern list, its version, provenance, and failure behavior.
2. Fail closed: do not recommend a skill when its security status, publisher identity, package contents, or version cannot be verified.
3. Retrieve and inspect the complete package manifest and contents rather than relying only on search-result metadata.
4. Verify publisher identity and track record using authoritative marketplace data. Do not infer credibility solely from the number of published skills.
5. Require an immutable package version and integrity hash in every recommendation, and ensure the installation command pins the exact reviewed version.
6. Review requested permissions and reject packages whose access exceeds their declared developer-tooling purpose.
7. Scan package instructions and executable content for credential access, external payload retrieval, command execution, persistence, memory modification, and unsafe shell construction.
8. Record evidence for every completed check in the report, including audit results, reviewed version, integrity value, publisher verification, and permission assessment.
9. Require explicit user approval before installation and clearly distinguish marketplace metadata from independently verified security conclusions.
10. Prefer sandboxed evaluation with minimal credentials, filesystem access, network access, and tool permissions before deployment into a production agent.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly instructs the agent to write a report into memory/reports/dev-intel-YYYY-MM-DD.md without telling the user that it will modify the workspace or asking for confirmation. While the write target appears limited and operationally useful, undisclosed file creation can still surprise users, alter state, and be chained with other behaviors to leave artifacts or influence later agent runs.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.