ClawHub
Back to skill

Security audit

Pm Sim

Security checks for vulnerabilities and agentic risk

Overview

This is a small deprecated skill that only tells users to install its renamed successor, with the main caution being an unpinned install command.

Before running the install command, confirm that `clawhub` and `polymarket-paper-trader` come from the expected publisher and consider using a pinned or otherwise verified version. Installing the renamed skill may add new tools or instructions that should be reviewed separately.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:3
Finding

Unpinned Remote Package Retrieval and Execution via npx

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 3-10
Vulnerability Type: Unpinned third-party package installation
Risk Level: Medium

Evidence

markdown
description: "[DEPRECATED] Renamed to polymarket-paper-trader. Run: npx clawhub install polymarket-paper-trader"
version: 0.2.0
---

# pm-sim is now polymarket-paper-trader

This skill has been renamed. Install the new version:

npx clawhub install polymarket-paper-trader

text

Technical Analysis

The documented command invokes clawhub through npx without specifying a package version or integrity constraint. If clawhub is not already available locally, npx may retrieve and execute its current registry version. The requested polymarket-paper-trader skill is likewise not version-pinned.

Consequently, the code executed or installed when a user follows this instruction is mutable and is not included in the audited project. A registry compromise, maintainer account compromise, malicious package update, or package-name takeover could cause future users to receive behavior different from what was available at audit time.

Attack Path

  1. An attacker compromises the package publishing account, registry entry, or distribution channel for clawhub or polymarket-paper-trader.
  2. The attacker publishes a malicious release under the expected package name.
  3. A user follows the instruction in SKILL.md and runs npx clawhub install polymarket-paper-trader.
  4. Because no version or integrity value is specified, the command retrieves mutable remote package content.
  5. Malicious package lifecycle code, CLI behavior, or installed skill instructions execute or become available in the user's environment.

Impact Assessment

Malicious clawhub code executed by npx could run with the privileges of the invoking user. Depending on that user's permissions and environment, it could read or modify accessible files, environ ...[truncated 445 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin both the installer and successor skill to explicitly reviewed versions rather than relying on the latest registry releases.
  2. Configure and document an approved registry instead of allowing implicit registry selection.
  3. Verify package provenance using publisher signatures, trusted release attestations, checksums, or lockfile integrity metadata before execution.
  4. Prefer downloading and inspecting the package before running it, rather than allowing npx to retrieve and immediately execute mutable code.
  5. Run installation in a sandbox or least-privileged environment without production credentials or sensitive filesystem access.
  6. Document the expected package publisher, exact version, and integrity digest so users can detect substitution or unauthorized updates.
  7. Periodically review pinned releases and update them only after security validation.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The manifest-level description embeds an installation command using npx clawhub without a version pin, which may be consumed automatically by tooling or surfaced directly to users. Embedding executable install guidance in metadata increases the chance that unreviewed, changing upstream code will be executed as part of a migration path.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
98% confidence
Finding

The skill metadata instructs users to run npx clawhub install polymarket-paper-trader without pinning a specific package or tool version. Unpinned npx execution can fetch whatever version is current at install time, creating a supply-chain risk where a compromised, typosquatted, or newly malicious upstream package could be executed.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
98% confidence
Finding

The deprecation notice tells users to execute npx clawhub install polymarket-paper-trader directly from the document body without a pinned version. Because npx resolves and runs remote packages dynamically, this exposes users to supply-chain compromise if the referenced package or installer changes unexpectedly.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.