ClawHub
Back to skill

Security audit

Nsfw Detection

Security checks for vulnerabilities and agentic risk

Overview

The artifact is a coherent NSFW/content-filtering skill description with no malicious instructions, but its npm-package and URL/domain handling require trust and privacy review.

Before installing, verify the npm package publishers and package contents, pin reviewed versions, use a lockfile or sandbox, and avoid analyzing sensitive private URLs or internal domains until you know whether the packages fetch remote content or query external reputation services.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:19
Finding

Unpinned and Unaudited Third-Party npm Dependencies

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 19–21, 79–81, and 100–102
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Affected code:

Lines 19–21:

bash
npm install @clawhub/nsfw-detector

Lines 79–81:

bash
npm install @clawhub/url-reputation

Lines 100–102:

bash
npm install @raghulpasupathi/nsfw-detection

Technical Analysis

The skill directs users to install three third-party npm packages without specifying reviewed versions. The project contains no package lockfile, package integrity hashes, vendored source code, dependency manifest, or implementation that would allow the installed components to be audited against the documented behavior.

An unversioned npm install normally resolves a mutable package release from the configured npm registry. npm packages can define lifecycle scripts, including installation hooks that execute locally during installation. Consequently, compromise of a publisher account, malicious release replacement, dependency confusion involving the configured registry, or compromise of a transitive dependency could result in attacker-controlled code executing on the user's system.

The instructions also reference packages under two different publisher scopes, @clawhub and @raghulpasupathi, without documenting their trust relationship or provenance. Although SKILL.md claims that the detector uses a local ONNX model and no external API, the repository provides no implementation or model artifact with which to verify that claim.

Attack Path

  1. A user follows the installation commands in SKILL.md.
  2. npm resolves the latest package versions from the user's configured registry because no versions are pinned.
  3. An attacker compromises a publisher, publishes a malicious package version, influences dependency resolution through an unsafe registry, or compromises a transitive dependency.
  4. npm downloads ...[truncated 1125 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin every direct dependency to a specific, reviewed version rather than allowing npm to resolve the latest release.
  2. Provide a dependency manifest and commit a lockfile containing registry-resolved integrity values.
  3. Use npm ci in automated and reproducible installations so dependency resolution matches the reviewed lockfile.
  4. Use npm ci --ignore-scripts or an equivalent policy where lifecycle scripts are unnecessary. If scripts are required, document and audit each script before enabling it.
  5. Verify package ownership, provenance, registry source, signatures, and publisher identity for both the @clawhub and @raghulpasupathi scopes.
  6. Audit direct and transitive dependency source code, including model-loading behavior and all network access.
  7. Publish or reference immutable, verifiable source and ONNX model artifacts, including cryptographic hashes, so the claim of local-only processing can be validated.
  8. Run installation and inference in a least-privileged sandbox or container without access to sensitive credentials, host files, or production networks.
  9. Enable dependency monitoring and require security review before updating pinned package or model versions.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The skill documentation shows detectNSFW(imageUrl) and emphasizes a local model, but it does not warn that supplying a remote URL may still require fetching external content. That can disclose user-provided URLs, trigger unexpected network access, and cause the system to contact attacker-controlled hosts or sensitive internal endpoints if inputs are not constrained.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The URL reputation feature states it checks domains using a reputation database and cached lookups, but it does not disclose that lookups may involve network queries to third-party services. This can leak users' browsing targets or sensitive domains and may create privacy, compliance, or operational risks in environments where queried URLs are confidential.

Content

No source excerpt is available for this finding.