ClawHub
Back to skill

Security audit

Geo Blocking

Security checks for vulnerabilities and agentic risk

Overview

The skill is a small, coherent geo-blocking description, but it directs users to install an unaudited, unpinned npm package that is not included in the artifact.

Review the npm package source and provenance before installing, prefer an exact reviewed version with lockfile or integrity metadata, and run initial testing in an isolated environment without unnecessary secrets. Also confirm how IP addresses, VPN/proxy checks, and Tor detection results are transmitted, stored, and retained.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:15
Finding

Unpinned and Unverified npm Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 15–18
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Complete Code Snippet:

markdown
**Installation**:
```bash
npm install @clawhub/geo-shield
text

### Technical Analysis

The installation command references `@clawhub/geo-shield` without an exact version, lockfile, integrity hash, provenance information, or corresponding source code in the audited project. Consequently, installation resolves registry-controlled package content that may change independently after this skill has been reviewed.

npm packages can define lifecycle scripts that execute during installation. Because the dependency implementation, transitive dependency tree, and lifecycle scripts are absent from the project, their behavior cannot be verified by this audit. This creates a supply-chain exposure if the package publisher account, package release process, registry resolution, or a transitive dependency is compromised.

The documentation advertises processing of IP geolocation, VPN/proxy status, and Tor usage. However, the package's handling, transmission, and storage of this potentially sensitive network information cannot be assessed from the supplied files.

### Attack Path

1. A user follows the documented installation instruction.
2. npm resolves the current registry version of `@clawhub/geo-shield` and its transitive dependencies.
3. An attacker who has compromised a package publisher, release pipeline, or dependency publishes a malicious version.
4. npm downloads the altered package because no audited exact version or integrity-controlled lockfile is specified.
5. Malicious lifecycle code can execute during installation, or malicious runtime behavior can execute when the package is used.
6. The payload operates with the permissions and accessible environment of the user or process running npm.

### Impact Assessment

Exploitation could perm
...[truncated 668 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the dependency to a reviewed exact version rather than allowing npm to resolve a mutable release.
  2. Commit a package manifest and lockfile containing registry URLs and integrity metadata.
  3. Document the authoritative source repository and verify package provenance or registry signatures where available.
  4. Audit the package's source, lifecycle scripts, release artifacts, and complete transitive dependency tree before recommending installation.
  5. In automated environments, use deterministic installation such as npm ci with a reviewed lockfile.
  6. Disable lifecycle scripts during initial inspection with npm install --ignore-scripts, then explicitly permit only scripts that have been reviewed and are necessary.
  7. Run installation and package execution with least privilege in an isolated environment without unnecessary credentials or host filesystem access.
  8. Document how IP addresses and detection results are collected, transmitted, retained, and protected, including any external services contacted by the package.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.