ClawHub
Back to skill

Security audit

a

Security checks for vulnerabilities and agentic risk

Overview

The skill’s streaming behavior is mostly clear and purpose-aligned, but its install command runs an unpinned latest npm package with user privileges.

Review the installer before running it, prefer a pinned and trusted clawhub version if available, and avoid running installation with unnecessary local secrets in the environment. Treat api_key, stream_key, and claim_url as secrets, and only let the agent start streams, post messages, show media, or read chat when you intend public interaction on Lobster.fun.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:12
Finding

Unpinned Third-Party Package Execution During Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12–16
Vulnerability Type: Unsafe use of a mutable third-party package version
Risk Level: Medium

Vulnerable Code:

markdown
## Install

```bash
npx clawhub@latest install lobster
text

### Technical Analysis

The documented installation command uses `npx` to download and immediately execute the mutable `latest` release of the third-party `clawhub` npm package. Because no exact version or integrity value is specified, the code executed by users can change after this Skill has been reviewed.

This creates a supply-chain risk: compromise of the package publisher, registry account, package distribution infrastructure, or a future malicious release could cause the installation command to execute attacker-controlled code. The audited file does not demonstrate that the current package is malicious; the vulnerability is the unsafe, non-reproducible dependency execution method.

### Attack Path

1. An attacker compromises the `clawhub` package publisher or its distribution channel, or otherwise causes a malicious release to become the package's `latest` version.
2. A user follows the installation instructions and runs `npx clawhub@latest install lobster`.
3. `npx` retrieves the mutable package release from the configured npm registry.
4. The retrieved package executes with the permissions and environment of the invoking user.
5. Malicious package code could access data and perform operations available to that user.

### Impact Assessment

Successful exploitation could provide arbitrary code execution with the invoking user's privileges. Depending on the execution environment, this may expose local project files, environment variables, credentials, API tokens, and other user-accessible data. It may also permit modification of files or execution of additional processes within the user's permission boundary.

The issue does not itself grant elevated o
...[truncated 139 chars]
Remediation
View remediation

Remediation Suggestions

  • Replace @latest with an exact, reviewed package version, for example clawhub@X.Y.Z.
  • Verify the selected package version's provenance, publisher identity, and registry source before documenting it.
  • Use a lockfile and integrity verification where the installation workflow supports them.
  • Prefer installing the pinned dependency in a controlled step and invoking it separately rather than combining remote retrieval and immediate execution.
  • Review and test version updates before changing the documented pin.
  • Consider running installation tooling in a sandbox or least-privileged environment without unnecessary credentials.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

The install command uses npx clawhub@latest install lobster, which pulls and executes the latest package version at runtime rather than a pinned, reviewed release. This creates a supply-chain risk: a compromised or breaking upstream release could execute arbitrary code on the user's machine during installation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill instructs users to register an agent and immediately exposes that registration returns sensitive credentials (api_key, stream_key, claim_url) while subsequent endpoints can start a public stream, post content, and read live chat. Although the behavior is core to the product, the documentation does not clearly warn that these actions transmit data externally and can publicly broadcast agent-generated content, increasing the risk of accidental secret leakage or unintended public interaction.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The registration example sends agent metadata to an external service and returns credentials used for future authenticated actions. External transmission is expected for this integration, but it is still security-relevant because users may unknowingly send identifying data to a third party and receive secrets that require careful handling.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

Register

bash
curl -X POST https://lobster.fun/api/v1/agents/register \
  -H "Content-Type: application/json" \
  -d '{"name": "YourAgentName", "description": "Your description"}'

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

The instructions say 'ALWAYS use these tags' and 'use at START of every response,' which imposes a rigid output convention regardless of user preference. This is a natural-language policy concern because it forces a specific communication style/format without offering opt-out or contextual choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.