ClawHub
Back to skill

Security audit

Algora Bounty Assistan

Security checks for vulnerabilities and agentic risk

Overview

This skill is a simple GitHub bounty-search CLI with no hidden persistence or credential handling, though its unpinned npx instructions create normal supply-chain caution.

Use this skill only if you are comfortable running an npm CLI that queries GitHub. Prefer pinning exact package versions or installing from a reviewed source before running the commands, and treat the included but unused analyze.js file as nonessential unless you intentionally inspect and run it yourself.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:27
Finding

Unpinned Third-Party Package Execution Through npx

Content
View full analysis
Remediation
View remediation
install github-bounty-hunter@1.0.0 ``` 2. Install dependencies through a committed lockfile with registry integrity metadata rather than relying on implicit retrieval of the latest release. 3. After verified installation, invoke the local package binary or use `npx --no-install` so execution fails instead of downloading an unreviewed package. 4. Document the expected package registry, publisher, source repository, and release checksum or provenance information. 5. Verify package signatures, provenance attestations, and integrity hashes before execution where supported. 6. Review lifecycle scripts and CLI entry points for each pinned release, and update versions only through a controlled dependency-review process. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

The code does generate a report on GitHub bounty-like issues, which partially aligns with the description. However, the key declared behavior—finding low-competition tasks with comments under 5—is not implemented at all. Instead, it retrieves up to 20 open issues with the bounty label, regardless of comment count, and ranks them by a custom valueScore derived from keywords such as 'bug', 'security', and 'api'. It also assigns a simplistic complexity label based on keyword presence. Because the primary selection criterion in the description is missing and the code introduces a different prioritization mechanism, the description does not accurately represent the actual behavior.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The installation command uses npx clawhub without pinning a specific version, so users may fetch and execute whatever package version is current at install time. That creates a supply-chain risk if a malicious or compromised update is published, and the skill context makes this more dangerous because the README explicitly instructs users to run the command directly.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The usage example tells users to run npx github-bounty-hunter without a pinned version, which can execute newly published package contents without review. Because this is presented as a one-step execution path, a compromised package release could directly lead to arbitrary code execution on the user's machine.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The parameterized invocation still uses unpinned npx, so it carries the same package substitution and malicious-update risk as the other example. The skill context increases exposure because users are encouraged to repeatedly run the command for daily scans, multiplying the chance of eventually pulling a bad release.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest says the skill will search for low-competition GitHub bounty tasks defined as comments < 5 and produce a report with estimated difficulty. In code, the GitHub query only searches for open bounty-labeled issues, and the results are analyzed and reported without any filtering on comment count; additionally, the report emits a 'complexity' heuristic rather than the manifest’s stated low-competition selection behavior.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/analyze.js (reported line 83)May include surrounding context.

js
const PER_PAGE = 20;

const query = `label:bounty state:open comments:<=${MAX_COMMENTS}`;
const url = `https://api.github.com/search/issues?q=${encodeURIComponent(query)}&per_page=${PER_PAGE}`;

function estimateDifficulty(title) {
  const lower = title.toLowerCase();

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/search.js (reported line 14)May include surrounding context.

js
const PER_PAGE = 20;

const query = `label:bounty state:open comments:<=${MAX_COMMENTS}`;
const url = `https://api.github.com/search/issues?q=${encodeURIComponent(query)}&per_page=${PER_PAGE}`;

function estimateDifficulty(title) {
  const lower = title.toLowerCase();

Static analysis

No suspicious patterns detected.