Firm Medtech Pack

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:14 AM UTC
• Version: 1.0.0

Overview

This medtech skill bundle is not malicious, but it should be reviewed because it combines session-orchestration authority with unpinned remote skill installation recommendations for sensitive healthcare workflows.

Install only after reviewing or pinning the ClawHub installer and each companion skill version. For PHI, adverse-event, audit, or regulatory work, use a restricted sandbox with no production credentials until the companion skills and session-orchestration permissions have been separately approved.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:40

Finding

Unpinned Third-Party Package Execution and Skill Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 40–46
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Complete Code Snippet:

bash

## Recommended ClawHub skills to install alongside

```bash
npx clawhub@latest install academic-research        # PubMed / clinical trial search
npx clawhub@latest install admet-prediction         # Drug candidate ADMET analysis
npx clawhub@latest install pdf-documents            # Clinical study PDF parsing
npx clawhub@latest install arc-security-audit       # 21 CFR Part 11 audit trail
npx clawhub@latest install firm-orchestration       # A2A orchestration backbone

Technical Analysis

The documented commands use npx clawhub@latest, which retrieves and executes a mutable release of the clawhub npm package. The commands also install five third-party skills without pinning them to audited versions, immutable commits, or verified integrity hashes.

Consequently, the code that executes and the skill content installed at a later date may differ from what was available when this project was audited. A compromised package publisher, registry account, package release, or companion skill could exploit this supply-chain trust boundary. The five referenced companion skills were not included in the audited project, so their behavior could not be independently verified.

Attack Path

1. An attacker compromises the npm package, its publisher account, the package distribution path, or one of the referenced companion skills.
2. The attacker publishes a malicious release under the mutable version selected by @latest, or changes an unpinned companion skill.
3. A user follows the installation commands from SKILL.md.
4. npx downloads and executes the currently resolved clawhub package.
5. The installer retrieves and activates unaudited companion skill content.
6. Malicious installation logic or skill instructions execute with the permissions and data access available to the inv ...[truncated 801 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace npx clawhub@latest with an exact, reviewed package version.
2. Enforce npm integrity verification through a lockfile, approved checksums, package signatures, or an internally controlled artifact repository.
3. Pin each companion skill to an immutable version, release digest, or commit hash rather than resolving its current release.
4. Audit the complete contents and transitive dependencies of every companion skill before installation or activation.
5. Perform installation in a restricted sandbox with no production credentials, PHI, patient records, or writable access to sensitive host locations.
6. Apply least privilege to the installer and installed skills, permitting only the tools, files, network destinations, and session access required for their stated functions.
7. Establish an allowlist and controlled update process so version changes require security review and integrity validation.
8. Scan newly resolved packages for installation scripts, unexpected network access, executable payloads, and instruction-hijacking behavior before deployment.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The skill recommends installing external packages with npx clawhub@latest, which fetches and executes the newest published code without version pinning. This creates a supply-chain risk: a compromised or malicious upstream release could be pulled at install time and run in a sensitive medtech environment.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

This line instructs users to install a skill through npx clawhub@latest, causing execution of whatever code is current in the registry at that moment. In regulated healthcare and pharma workflows, unpinned remote execution increases the chance of supply-chain compromise affecting PHI-handling or compliance-related processes.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

Using npx clawhub@latest for PDF parsing skill installation leaves the environment exposed to arbitrary future package changes, including malicious publish events or dependency hijacking. Because these tools may process clinical documents, the blast radius includes sensitive data access and workflow integrity.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

This recommendation installs a security-audit-related tool via npx clawhub@latest, so users may trust and execute unreviewed code specifically in compliance or audit contexts. A supply-chain compromise here is especially dangerous because it could falsify, weaken, or tamper with audit-related workflows in a 21 CFR Part 11 setting.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

Installing the orchestration backbone with npx clawhub@latest introduces unpinned remote code execution at the core coordination layer of the firm workflow. If compromised, an attacker could influence multiple departments' agent behavior, data handling, and compliance outputs across the medtech environment.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The support section switches to French ('Si ce skill vous est utile...') without offering a language choice or indicating that the skill is intentionally French-only. This can violate the language/locale policy for natural-language content because users are not given an opt-in or alternative.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.