T08 · Insecure Dependencies
Warning
- Location
SKILL.md:42- Finding
Unpinned Third-Party Installer and Skill Dependencies
- Content
View full analysis
- Remediation
View remediation
Security audit
Firm Ecommerce Pack
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed e-commerce orchestration skill bundle with no embedded executable payload, but users should review its optional unpinned companion-install commands before running them.
Install this only if you want a broad e-commerce multi-agent workflow bundle. Before running the optional companion install commands, verify the publisher and consider pinning reviewed ClawHub and skill versions, especially in workspaces with customer, payment, CRM, analytics, or production access.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The description says the bundle 'Activates the firm pyramid' for broad e-commerce workflows, but it does not define specific invocation phrases, scope boundaries, or exclusion conditions. This ambiguity could cause unintended invocation because the activation criteria are described only in general business terms.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The skill instructs users to run
npx clawhub@latest install ..., which fetches and executes the latest published package version at install time rather than a reviewed, immutable version. If the upstream package or dependency chain is compromised, users could execute untrusted code during installation or skill setup.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
This command uses
npx clawhub@latest, which is a moving target and can execute newly published code without prior review. In a skill document, such install guidance increases supply-chain risk because operators may copy-paste the command directly into privileged environments.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
Referencing
npx clawhub@latestallows remote code execution from whatever package version is current at execution time. That creates a supply-chain exposure that is especially relevant for operational automation skills likely to be installed in environments with API keys, customer data, or deployment access.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The install instruction relies on
@latest, which prevents reproducibility and permits silent drift to potentially malicious or broken releases. Because this bundle is aimed at business workflow automation, compromise could affect multiple downstream integrated services.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
Using
npx clawhub@latestintroduces supply-chain risk by executing code retrieved at runtime from a mutable package reference. In practice, users may trust the documentation and run it without sandboxing, exposing local credentials and workspace contents if the package is compromised.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
This recommendation executes a non-pinned package via
npx, making the security posture dependent on the current state of the npm registry and package publisher accounts. A compromise or typo-squatted substitution could lead to arbitrary code execution during installation.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The command at this line uses a mutable latest-tagged package reference, which is a genuine supply-chain weakness rather than a purely stylistic issue. Given the skill's orchestration focus and declared session tools, compromise could chain into broader agent workflows if an operator installs the companion tooling blindly.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The support text is written in French ('Si ce skill vous est utile...') while the rest of the skill is in English, with no indication that the user chose French or that the skill is region-specific. This creates a locale inconsistency that can violate language policy expectations for user-facing content.
- Content
Static analysis
No suspicious patterns detected.