Security audit

Fomo Research (DEPRECATED)

Security checks for vulnerabilities and agentic risk

Overview

This deprecated skill only tells users not to use it and points them to a replacement, but its suggested install command should be verified before running.

Before following the replacement install command, confirm that `clawhub` and `fomo-research` are the intended packages and prefer a pinned or otherwise verified installation path if available. The inspected skill itself is only a deprecation notice.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:10
Finding: Unpinned Remote Dependency Installation Through npx
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: The manifest metadata itself embeds an install command referencing npx clawhub without any version pin. Even though this is descriptive metadata, downstream tooling or users may surface and trust it as installation guidance, extending the same supply-chain risk from unpinned remote package execution.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The skill instructs users to run npx clawhub install fomo-research without pinning a specific version. Unpinned npx execution can fetch whatever package version is current at execution time, creating a supply-chain risk if a malicious or compromised release is published later. The deprecation context does not remove this risk because the file still actively directs users to execute the command.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: This code block repeats an unpinned npx clawhub install fomo-research command. Because npx resolves and executes packages dynamically, anyone following the instruction may run unexpected code from a future or compromised package version, making this a real supply-chain exposure.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.