Sovereign Content Machine

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 10:51 PM UTC
• Version: 1.0.0

Overview

This skill is a content-marketing assistant made of Markdown instructions, with no hidden code or automatic account access found.

Reasonable to install if you want content-strategy help. Avoid pasting customer identifiers, credentials, private exports, or confidential raw analytics; use aggregated metrics instead. Prefer the normal `clawhub install` path or a pinned/verified CLI version over the optional unpinned npx command.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:13

Finding

Unpinned npm Package Download and Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 13-17
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code

markdown

Or if using npx:

```bash
npx clawhub install sovereign-content-machine

text

### Technical Analysis

The documented installation command invokes `clawhub` through `npx` without specifying an exact package version, registry, or integrity hash. If the package is not already available locally, `npx` may retrieve a package from the configured npm registry and immediately execute its command.

Consequently, the code executed by this command is not immutable and cannot be fully evaluated from the audited project. Its behavior may change after this project has been reviewed. The risk would become exploitable if the upstream npm package, its publishing account, one of its transitive dependencies, or the user's configured registry were compromised.

The repository provides no package lockfile, checksum, signature-verification procedure, or reviewed local implementation that binds this instruction to a known artifact. This is a supply-chain weakness rather than evidence that the current `clawhub` package is malicious.

### Attack Path

1. An attacker compromises the `clawhub` npm package, its publisher credentials, a relevant dependency, or a registry from which the package is resolved.
2. The attacker publishes a malicious package version or causes dependency resolution to return an attacker-controlled artifact.
3. A user follows the documented command:
   ```bash
   npx clawhub install sovereign-content-machine
   ```
4. `npx` downloads the currently resolved package version because no exact version or integrity constraint is specified.
5. The package CLI or applicable package lifecycle code executes with the privileges of the user running the command.
6. The malicious code can perform any operation available to that user before
...[truncated 901 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the CLI to an explicitly reviewed version:

   bash

   npx --yes clawhub@<reviewed-version> install sovereign-content-machine
   

2. Document the expected npm registry and publish the integrity digest or signed provenance for the reviewed package artifact.
3. Recommend installing and verifying clawhub separately, then invoking the verified local executable rather than allowing an installation instruction to download and execute the latest release automatically.
4. Add a security note warning users not to run installation commands with sudo or another elevated account.
5. Periodically review the pinned CLI release and its transitive dependency tree before updating the documented version.
6. Where supported, require package signatures, registry provenance attestations, and lockfile or integrity verification to ensure that installation resolves to the audited artifact.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · EXAMPLES.md (reported line 226)May include surrounding context.

md

**3. Fix Your Hook Game**
- Your recent tweets likely start with statements. Switch to patterns that stop the scroll:
  - Instead of: "I found a great tool for managing environment variables."
  - Try: "Stop manually managing .env files. This tool syncs them across your entire team in 30 seconds:"
- Lead with the outcome, not the topic.

**4. Engage 20+ Minutes Per Day**

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The README instructs users to run npx clawhub install sovereign-content-machine without pinning an exact package version. npx resolves and executes code from the registry at install time, so a compromised latest release, dependency hijack, or malicious republish could cause arbitrary code execution on the user's machine. In a skill-installation context, this is more dangerous because readers are likely to copy-paste the command directly from documentation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill description is very broad and does not define clear activation boundaries, increasing the chance the agent invokes it in situations outside intended content-strategy tasks. Over-broad routing can expose unrelated user data to the skill's instructions and cause inappropriate collection, transformation, or scheduling recommendations in contexts where it should not run.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The audit workflow explicitly asks for cross-platform inventory, engagement metrics, and conversion data but provides no warning to minimize, redact, or obtain consent for potentially sensitive business or personal information. In practice, this can lead users to paste private analytics, customer data, campaign performance, or account details into the skill without safeguards, creating unnecessary privacy and confidentiality exposure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The example specifies a newsletter schedule at 'Every Tuesday at 9 AM EST,' which bakes in a specific US time locale as the default output guidance. Because the file presents example outputs without noting that timing should be adapted to the user's locale or preference, it can be read as forcing a locale-specific convention without opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.