ClawHub
Back to skill

Security audit

github-bounty-hunter-v2

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to do what it says: it queries GitHub for public bounty-labeled issues and prints a report, with a supply-chain caution around unpinned npx commands.

Before installing, prefer a pinned package version or a reviewed local install path, and run it from an environment without unnecessary secrets. Expect it to contact GitHub's API and print public issue results; no local data access was found.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:31
Finding

Unpinned Packages Fetched and Executed Through npx

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 31 and 37
Vulnerability Type: Supply-chain risk caused by executing unpinned registry packages
Risk Level: Medium

Vulnerable Code

bash
npx clawhub install github-bounty-hunter
bash
npx github-bounty-hunter

Technical Analysis

The documented commands invoke npm packages through npx without specifying audited versions or integrity constraints. If a referenced package is not already installed locally, npx may retrieve the currently resolved package version from the configured npm registry and execute its lifecycle or CLI code.

Consequently, the code reviewed in this project is not guaranteed to be the same code that a user executes by following the documentation. A compromised publisher account, package takeover, malicious new release, dependency confusion condition, or compromised package dependency could alter the effective executable payload after this audit.

Attack Path

  1. An attacker compromises the publishing account, registry package, or dependency chain associated with clawhub or github-bounty-hunter.
  2. The attacker publishes a malicious version under the package name referenced by the documentation.
  3. A user follows the installation or usage instructions in SKILL.md.
  4. npx resolves and downloads the mutable package version from the configured registry.
  5. Malicious lifecycle scripts or CLI entry-point code execute with the privileges of the user running the command.

Impact Assessment

Successful exploitation can provide arbitrary code execution under the invoking user's account. Depending on that account's permissions and environment, the malicious package could access readable files, source code, environment variables, developer credentials, SSH configuration, npm tokens, or other user-level resources. It could also modify user-owned files and make outbound network requests.

This issue does ...[truncated 247 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin every remotely resolved package to a specifically reviewed version rather than relying on the registry's current resolution, for example npx github-bounty-hunter@1.0.0.
  • Pin the installer package as well, rather than invoking an unversioned clawhub package.
  • Use a lockfile containing integrity hashes when distributing or installing the project through npm.
  • Prefer invoking a locally installed, reviewed binary with npm exec --no or an equivalent mechanism that refuses implicit downloads.
  • Verify package provenance, publisher identity, source repository, release signatures, and registry integrity before execution.
  • Disable or carefully review package lifecycle scripts during installation where operationally possible.
  • Document the exact audited package version and checksum so users can verify that the downloaded artifact matches the reviewed release.
  • Run installation and CLI commands using a least-privileged account in an isolated environment, without unnecessary credentials in environment variables.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/search.js (reported line 14)May include surrounding context.

js
const PER_PAGE = 20;

const query = `label:bounty state:open comments:<=${MAX_COMMENTS}`;
const url = `https://api.github.com/search/issues?q=${encodeURIComponent(query)}&per_page=${PER_PAGE}`;

function estimateDifficulty(title) {
  const lower = title.toLowerCase();

Static analysis

No suspicious patterns detected.