heart-of-light

• Outcome: Pass
• Latest audit: Sep 7, 2026 · 11:45 AM UTC
• Version: 3.0.5

Overview

The skill is an opt-in local communication and text-audit helper with disclosed, workspace-scoped file use and no evidence of hidden network, credential, or host-configuration behavior.

This skill is reasonable to install if you want opt-in communication guidance and a local heuristic text audit. Review the state and feedback file paths before enabling writes, avoid putting secrets in audit text or feedback notes, and use a pinned ClawHub installer command rather than a mutable `@latest` command when installing in a sensitive environment.

A.I.G

By Tencent

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:40
• Finding: Unpinned Third-Party Package Is Downloaded and Executed During Installation## Vulnerability Details **File Location**: `README.md:40` **Vulnerability Type**: Supply-chain risk caused by executing a mutable package release **Risk Level**: Medium ### Vulnerable Code ```bash npx --yes clawhub@latest install @orionshaowswmw/heart-of-light ``` ### Technical Analysis The documented installation command instructs `npx` to retrieve and execute the `latest` release of the third-party `clawhub` package. The `latest` tag is mutable, so the code executed by a future user may differ from the version that was available when this Skill was audited. The `--yes` option suppresses the normal installation confirmation. Consequently, following the documented command can download and execute unaudited code without an opportunity to review the resolved package version. Although this command is documentation rather than an automatic runtime action, it establishes an unsafe installation path. The reviewed Skill implementation itself does not contain runtime network access, dependency loading, or remote payload execution. The risk is confined to users who follow this installation instruction. ### Attack Path 1. An attacker compromises the npm package, its publisher account, release process, or an upstream dependency used by a future `clawhub` release. 2. The compromised release is assigned the mutable `latest` distribution tag. 3. A user follows the installation command in `README.md`. 4. `npx --yes` downloads the currently resolved release and executes its package entrypoint without interactive confirmation. 5. The malicious package runs with the operating-system permissions of the user who invoked the command. 6. It could access or modify any files, credentials, processes, or network resources available to that user, independently of the narrow permissions declared by this Skill. ### Impact Assessment Successful exploitation permits arbitrary code execution with the installer user's privileges. The practical ...[truncated 409 chars]
• Remediation: ## Remediation Suggestions 1. Replace the mutable `@latest` reference with an exact, reviewed version: ```bash npx clawhub@<audited-exact-version> install @orionshaowswmw/heart-of-light ``` 2. Remove `--yes` where practical so users can inspect and approve the resolved package before execution. 3. Publish expected package provenance and integrity information, such as the registry source, exact version, and cryptographic digest. 4. Recommend inspecting the package metadata and resolved dependency tree before execution. 5. For sensitive environments, document a download-and-verify workflow that separates package retrieval from execution. 6. Avoid running the installer with administrator privileges and use a restricted environment with only the filesystem and network access required for installation.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill advertises itself as needing no special capabilities, but its documented helper uses environment variables and local file read/write operations for mode state, feedback, and audits. That mismatch can weaken host trust assumptions and allow unexpected workspace modification or data access if the helper is invoked without clear permission boundaries.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.