ClawHub
Back to skill

Security audit

Firm Saas Pack

Security checks for vulnerabilities and agentic risk

Overview

This is a mostly coherent SaaS orchestration bundle, but it recommends unpinned installs of several powerful companion skills and does not clearly bound write-capable workflows.

Review this skill before installing in a real company workspace. Prefer pinned ClawHub and skill versions, inspect each companion skill separately, use least-privilege credentials, and require human approval before creating PRs, updating Jira/docs, merging PRs, or processing CRM and financial exports.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:48
Finding

Unpinned Third-Party Package Execution and Skill Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 48-58
Vulnerability Type: Supply-chain exposure through mutable, unpinned dependencies
Risk Level: Medium

Vulnerable Code Snippet:

bash
npx clawhub@latest install azure-devops             # Azure Boards / ADO integration
npx clawhub@latest install auto-pr-merger           # Automated PR workflow
npx clawhub@latest install agent-audit              # Performance/cost ROI audit
npx clawhub@latest install adhd-founder-planner     # Sprint day planning
npx clawhub@latest install biz-reporter             # ARR / churn / MRR dashboards
npx clawhub@latest install firm-orchestration       # A2A orchestration backbone
npx clawhub@latest install firm-delivery-export     # Output → PR / Jira / doc

Technical Analysis

The documented installation procedure invokes the mutable latest release of the third-party clawhub npm package through npx and installs seven third-party skills without fixed versions, integrity hashes, or source-verification requirements.

The effective code obtained by a user can therefore change after this skill has been reviewed. Running npx may download and execute package code under the invoking user's identity. The subsequently installed skills may also contain executable instructions, scripts, integrations, or lifecycle behavior that is not present in this repository and was not covered by this audit.

This is a supply-chain weakness rather than evidence that any currently named package is malicious. Exploitation depends on a future compromise, malicious release, account takeover, dependency confusion condition, or unexpected upstream change.

Attack Path

  1. An attacker compromises an upstream package, publisher account, distribution channel, or one of the recommended skills.
  2. The attacker publishes a malicious release that becomes the version selected by @latest, or changes an unpinned skill release retrieved ...[truncated 1127 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace clawhub@latest with a specific, reviewed version.
  2. Pin every recommended skill to an immutable version or cryptographic digest where the package manager supports it.
  3. Record expected package sources, publisher identities, checksums, and signatures.
  4. Use a lockfile or equivalent reproducible dependency manifest.
  5. Download and inspect third-party skill contents before activation, including scripts, lifecycle hooks, tool declarations, and network behavior.
  6. Disable package lifecycle scripts during acquisition where feasible, enabling them only after review.
  7. Perform installation in a sandbox with minimal filesystem, credential, environment-variable, and network access.
  8. Establish an update-review process rather than automatically tracking the newest upstream release.
  9. Document that the listed packages are external recommendations and are outside this repository's audit boundary.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (9)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill description is very broad, advertising activation across many departments and workflows without clear trigger boundaries or limiting conditions. In an agent setting, over-broad activation increases the chance that the skill is invoked in unrelated contexts and gains influence over sensitive planning, engineering, finance, or support tasks beyond user intent.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The skill recommends installing external packages via npx clawhub@latest install ..., which pulls the latest publisher-controlled code at execution time rather than a reviewed, pinned version. If the package, dependency chain, or distribution channel is compromised, users could execute unexpected code or install a malicious skill bundle.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

Using npx clawhub@latest for skill installation causes users to fetch and run mutable code from the registry with no version stability or integrity guarantee. This creates a supply-chain risk where a future package update or account compromise can change behavior after publication of this skill.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The install command references a non-pinned npx package, meaning execution depends on whatever code is current in the registry at runtime. In a security-sensitive agent ecosystem, this can lead to arbitrary code execution or installation of unsafe downstream skills if the upstream package is altered.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

This command encourages installation through npx clawhub@latest, which is effectively a moving target and introduces avoidable supply-chain risk. Because the skill bundle is aimed at operational workflows, a compromised install path could grant broad influence over agent behavior and connected tooling.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

Fetching clawhub with @latest delegates trust to future unpublished changes rather than the reviewed state of the package at authoring time. That makes the skill materially more dangerous because it is a curated bundle likely to be copied verbatim by users and reused in automated environments.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The documented install flow uses a mutable package reference, allowing the executed installer logic to change without any corresponding update to this skill document. Since the referenced companion skill relates to orchestration/output workflows, compromise could cascade into broad automation misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The markdown recommends a companion skill for exporting outputs to PRs, Jira, and docs but does not warn users that this may write to external systems or propagate sensitive data. In this SaaS context, the bundle also references churn analysis, CRM exports, and product workflows, so silent publication or synchronization could leak internal or customer information and cause unintended changes in production workflows.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

Relying on npx clawhub@latest for a delivery/export-oriented companion skill creates a supply-chain and execution-trust problem. If abused, it could install tooling that writes to PRs, Jira, or docs with attacker-controlled content or logic.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.