AI Income Agent

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:32 AM UTC
• Version: 1.0.0

Overview

This skill is not clearly malicious, but it asks an agent to perform account-linked publishing and ongoing monetization work with weak scoping and unsafe credential/install examples.

Review this before installing if you plan to let an agent act autonomously. Use explicit approvals before publishing, logging, or account actions; avoid placing real tokens in shell commands; prefer a pinned/local CLI install; and inspect any generated skill before publishing it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:249

Finding

Unpinned Global Installation of a Third-Party CLI Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 249-250
Vulnerability Type: Unpinned and globally installed third-party dependency
Risk Level: Medium

Complete Code Snippet:

bash

# 1. Install clawhub CLI
npm install -g clawhub

Technical Analysis

The Quick Start instructions install the latest available version of the clawhub npm package globally. The command does not pin a reviewed version, use a lockfile, verify package integrity, identify the expected registry, or otherwise validate the downloaded package.

npm installations may execute package lifecycle scripts with the permissions of the invoking user. Consequently, a compromised maintainer account, malicious package release, package-name takeover, or registry compromise could cause arbitrary code to run during installation. The global installation flag also gives the package a broader installation scope than is necessary merely to invoke a command-line tool. Depending on the npm configuration, this can modify user-global paths or require elevated privileges.

This is a supply-chain risk rather than evidence that the current clawhub package is malicious.

Attack Path

1. An attacker compromises the package publisher, package distribution account, or an associated supply-chain component.
2. The attacker publishes a malicious or backdoored version under the package name used by the instructions.
3. A user follows the Quick Start instructions without specifying a trusted version.
4. npm retrieves the attacker's latest release and may execute its lifecycle scripts during installation.
5. The malicious package runs with the privileges of the user executing npm and can access resources available to that account.
6. Because the package is installed globally, the compromised executable remains available for later invocations until removed.

Impact Assessment

Successful exploitation could permit arbitrary code execution und ...[truncated 503 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the CLI to a specifically reviewed version rather than installing the latest release implicitly.
• Verify the package publisher, expected npm registry, release provenance, and integrity metadata before installation.
• Prefer a project-local dependency recorded in a lockfile instead of a global installation.
• Where compatible with the package, disable lifecycle scripts during installation and review any scripts before enabling them.
• Avoid recommending elevated installation commands such as sudo npm install -g.
• Document a controlled upgrade process in which new package versions are reviewed before adoption.
• Provide removal and rollback instructions for the installed CLI.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:252

Finding

Authentication Token Passed as a Command-Line Argument

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 252-253
Vulnerability Type: Sensitive credential exposure through process arguments and shell history
Risk Level: Medium

Complete Code Snippet:

bash

# 2. Log in
clawhub login --token YOUR_TOKEN

Technical Analysis

The login example instructs users to replace YOUR_TOKEN with an authentication token directly in a command-line argument. Command-line secrets may be retained in shell-history files, terminal transcripts, debugging output, command telemetry, support bundles, or automation logs. On systems where process arguments are visible to other users or monitoring tools, the token may also be exposed while the command is running.

Although the documented value is only a placeholder and no actual secret is embedded in the project, the recommended credential-handling pattern is insecure when followed with a real token.

Attack Path

1. A user replaces YOUR_TOKEN with a valid ClawHub authentication token.
2. The user executes the command in an interactive shell or logged automation environment.
3. The complete command is recorded in shell history, terminal logging, process monitoring, CI logs, or another diagnostic source.
4. A local user, log reader, support operator, malicious process, or party obtaining a copied history file retrieves the token.
5. The attacker submits the token to ClawHub and performs actions authorized by the token until it expires or is revoked.

Impact Assessment

The attacker could obtain the same ClawHub privileges granted to the exposed token. Depending on its scope, this may include accessing the associated account, inspecting private account information, publishing or modifying skills, or performing other authenticated operations.

The issue does not itself provide operating-system privilege escalation. Its scope is bounded by the token's permissions, validity period, and any server-side restrictions.

Remediation

View remediation

Remediation Suggestions

• Replace the command-line token argument with an interactive, non-echoing credential prompt.
• If supported, read the token from standard input or a protected operating-system credential store.
• Ensure the CLI stores credentials only in a file with restrictive permissions or in the platform's native secret manager.
• Avoid examples that place secrets directly in shell commands, scripts, command history, or environment variables that may be broadly observable.
• Add an explicit warning that users must not substitute a real token into a visible command-line argument.
• Recommend narrowly scoped, short-lived tokens and document immediate revocation and rotation procedures for suspected exposure.
• Ensure application and CI logging redact authentication tokens.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

bash

clawhub search "[category]" --limit 10
curl -s "https://clawhub.ai/api/v1/skills?limit=30&sort=downloads" | python3 -c "
import sys,json
data=json.load(sys.stdin)
for s in data.get('items',[]):

Self-Modification

High

• Category: Rogue Agent
• Confidence: 86% confidence

Finding

The skill directs creation of a new SKILL.md and uses another skill as a template, which is a form of agent-assisted self-extension or self-modification. While framed as product creation, it can enable the agent to generate and propagate new capabilities without review, increasing the chance of unsafe or policy-violating instructions being published.

Content

Scanner excerpt · SKILL.md (reported line 265)May include surrounding context.

md

# 3. Create your first skill
mkdir -p ~/.openclaw/workspace/skills/my-first-skill
# Write SKILL.md (use ai-productivity-audit as a template)

# 4. Publish
clawhub publish ~/.openclaw/workspace/skills/my-first-skill \

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are broad enough to match ordinary user requests about income, automation, or monetization, which can cause the skill to activate in situations where the user did not explicitly ask for marketplace publishing, affiliate marketing, or autonomous operational behavior. In this skill, that overreach is riskier because the instructions also encourage account actions, publishing, monitoring, and revenue-seeking workflows that could lead to unintended external actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the agent to append results to a local memory file in the user's home directory without warning, consent, or guardrails around what may be stored. This creates a persistence channel that can modify user data unexpectedly and may accumulate sensitive operational details over time.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

The workflow stores artifacts under ~/.openclaw/workspace and pairs that with authenticated CLI use, creating durable session-linked state that can persist across runs. In context, persistence is not inherently malicious, but it becomes security-relevant because the skill is designed for ongoing autonomous monetization and repeated marketplace operations.

Content

Scanner excerpt · SKILL.md (reported line 263)May include surrounding context.

md

# 2. Log in
clawhub login --token YOUR_TOKEN

# 3. Create your first skill
mkdir -p ~/.openclaw/workspace/skills/my-first-skill
# Write SKILL.md (use ai-productivity-audit as a template)

Static analysis

No suspicious patterns detected.