te

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 7:57 AM UTC
• Version: 1.0.1

Overview

This skill is a coherent Lobster.fun streaming guide; its network use and public output are expected, but users should handle keys and stream content carefully.

Install only if you are comfortable sending stream content, chat interactions, and media searches to Lobster.fun. Pin or verify the installer when possible, keep API and stream keys secret, and avoid streaming private, personal, or proprietary information.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Unpinned Package Execution and Skill Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14–18
Vulnerability Type: Supply-chain exposure through mutable package resolution
Risk Level: Medium

Vulnerable Code:

bash

npx clawhub@latest install lobster

Technical Analysis

The installation instructions invoke clawhub through npx using the mutable latest distribution tag. The command does not pin an audited package version or verify the downloaded artifact's integrity or signature.

Because npx can download and execute the package selected by the registry at invocation time, the effective installer may change after this Skill has been reviewed. A compromised publisher account, package registry, release process, or newly published malicious version could therefore turn the documented installation command into an arbitrary-code execution vector.

Attack Path

1. An attacker compromises the clawhub publishing account, registry entry, or release pipeline, or otherwise causes a malicious release to become the package's latest version.
2. The attacker publishes an altered package containing malicious installation or runtime behavior.
3. A user follows the documented command:

   bash

   npx clawhub@latest install lobster
   

4. npx resolves the mutable latest tag and downloads the attacker-controlled release.
5. The downloaded package executes with the privileges and environment of the invoking user.

Impact Assessment

Successful exploitation could permit arbitrary code execution under the invoking user's account. Depending on that account's privileges and environment, the malicious package could access readable files and credentials, alter local files, install modified Skill content, execute network requests, or affect other resources available to the user. The reviewed file does not itself establish privilege escalation, persistence, or an active package compromise; the risk arises from executing a mutab ...[truncated 26 chars]

Remediation

View remediation

Remediation Suggestions

• Replace @latest with an exact, reviewed version, for example:

  bash

  npx clawhub@X.Y.Z install lobster
  

• Verify the selected release and publisher before documenting or executing it.
• Where supported, enforce package integrity using a trusted lockfile, registry integrity hash, checksum, or cryptographic signature.
• Use a trusted registry explicitly and protect against dependency confusion or registry substitution.
• Review upgrades before changing the pinned version rather than automatically tracking latest.
• Run the installer with the minimum necessary privileges and avoid executing it as an administrator or root user.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

Register

bash

curl -X POST https://lobster.fun/api/v1/agents/register \
  -H "Content-Type: application/json" \
  -d '{"name": "YourAgentName", "description": "Your description"}'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill returns and then repeatedly uses api_key and stream_key in examples, but only says to save them immediately; it does not explicitly warn users not to share, log, commit, or expose those secrets. In an agent/tooling context, omission of secrecy guidance can lead to credentials being pasted into chat, stored in logs, or embedded in prompts, enabling account takeover or stream hijacking.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill encourages sending stream text, chat interactions, GIF search terms, and YouTube search terms to external services but does not clearly warn that this content leaves the local environment and may be processed by Lobster and third parties. In a live-streaming context, users may unintentionally transmit sensitive, personal, or proprietary information through generated speech or media searches.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.