Find Skills Skill Rose

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:37 AM UTC
• Version: 1.0.0

Overview

This skill is simple skill-discovery documentation, but it repeatedly tells agents to run an unpinned npm CLI that could execute changing registry code.

Install only if you are comfortable with the agent being instructed to run `npx clawhub` for searches. Prefer a locally installed, reviewed ClawHub CLI or commands pinned to an exact trusted version, especially on machines with sensitive files, credentials, or broad agent permissions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:32

Finding

Unpinned npm Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 32-38 and 59-90
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

The skill directs the agent to execute the clawhub npm package through npx without specifying a trusted version, lockfile, package integrity value, or verified source.

Relevant code snippets:

bash

### 1. ClawHub (Primary)
```bash
# Search skills
npx clawhub search "keyword"

# Browse categories
npx clawhub browse

text

Additional unpinned invocations are present in the search examples:

```bash
### By Functionality
```bash
# Web search skills
npx clawhub search "web search"

# Weather skills
npx clawhub search "weather"

# Document skills
npx clawhub search "document"

By Provider

bash

# Tavily skills
npx clawhub search "tavily"

# GitHub skills
npx clawhub search "github"

# Calendar skills
npx clawhub search "calendar"

By Popularity

bash

# Most installed skills
npx clawhub search --sort installs

# Most starred skills
npx clawhub search --sort stars

text

### Technical Analysis

When the requested package is not already installed locally, `npx` can retrieve it from the configured npm registry and execute its package code. Because the instructions use the mutable package name `clawhub` without an explicit version or integrity verification, the effective code executed by the agent can differ from the code that was previously reviewed.

This creates a supply-chain trust boundary around the npm registry, the package publisher account, registry configuration, and name resolution. A compromised publisher account, malicious package release, registry substitution, or unsafe registry configuration could cause attacker-controlled package lifecycle or runtime code to execute locally.

The repository itself does not contain a malicious script, and the audit found no evidence 
...[truncated 1447 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin clawhub to a specific, reviewed version in every command, for example:

   bash

   npx --yes clawhub@<reviewed-version> search "keyword"
   

2. Verify the selected release's publisher, provenance, checksums, signatures, and package contents before approving it.

3. Prefer installing the dependency through a project manifest and lockfile so that the exact dependency graph and integrity hashes are recorded and reviewable.

4. Configure npm to use an explicitly trusted registry and prevent user-controlled or environment-controlled registry substitution where practical.

5. Disable or review package lifecycle scripts during installation when they are not required.

6. Execute the CLI in a sandbox with minimal filesystem access, no unnecessary secrets, restricted network access, and no administrative privileges.

7. Document an update-review process rather than automatically consuming the latest registry release.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (10)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The skill instructs users to run npx clawhub search "keyword" without pinning an exact package version. npx will fetch and execute the latest published package, so a compromised upstream package, malicious version publish, or dependency hijack could result in arbitrary code execution on the user's machine at invocation time.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

This command uses unpinned npx clawhub browse, which causes remote code to be downloaded and executed from the npm registry without a fixed version. If the package or one of its dependencies is tampered with, the user could execute attacker-controlled code simply by following the documented usage.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The skill recommends npx clawhub search "web search" without version pinning, exposing users to supply-chain risk from whatever version npm serves at runtime. Because this is framed as routine skill discovery, users may execute it casually, increasing the likelihood of unsafe code execution if the package is ever compromised.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

This example invokes npx clawhub search "weather" without constraining the package version, so the executed code can change over time without review. That creates a supply-chain execution path where a malicious publish or takeover of the package can lead to arbitrary local command execution.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

Using npx clawhub search "document" without an exact version means the skill depends on transient registry state and executes whatever current package release is available. If that release is malicious or compromised, users can be exposed to arbitrary code execution despite only intending to search for skills.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The provider search example runs unpinned npx clawhub search "tavily", which is a standard supply-chain risk pattern because npx executes downloaded package code immediately. An attacker controlling the package publication path could abuse this instruction to run code on systems following the documentation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

This npx clawhub search "github" usage is unpinned and therefore trusts the latest npm-published package at execution time. The danger is not the search term but the dynamic remote code execution behavior of npx, which can be exploited through package compromise or dependency-chain attacks.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The example npx clawhub search "calendar" executes a package without version pinning, allowing silent drift to new code over time. In practice, that means anyone following the skill may execute compromised package contents if the upstream package or dependency tree is hijacked.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

npx clawhub search --sort installs is another unpinned remote package execution path. Because sorting by popularity is a common task, this broadens exposure by encouraging repeated execution of non-version-locked code that may later become malicious.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The command npx clawhub search --sort stars references an unpinned npm package, creating a supply-chain vulnerability through runtime retrieval and execution of the latest release. The surrounding context is discovery/documentation, which makes the intent appear non-malicious, but it still normalizes unsafe execution practices.

Content

No source excerpt is available for this finding.