ClawHub
Back to skill

Security audit

unhuman

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its domain-management purpose, but it uses unpinned npm commands for sensitive domain and Bitcoin-wallet operations.

Review before installing. Use only pinned, reviewed versions of the npm packages, keep domain-management tokens and wallet data isolated, and require clear user approval for registrations, renewals, DNS or nameserver changes, and any wallet-enabled payment.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:7
Finding

Unpinned Third-Party Packages Executed Through npx

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (15)

YARA rule 'ransomware_behavior': Ransomware-like patterns (mass encryption, ransom notes) [malware]

Critical
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: unhuman
description: Search, register, and manage domain names via unhuman.domains. Pay with bitcoin using agent-wallet. Use when the user wants to find available domains, register a new domain, manage DNS records, update nameservers, or renew a domain.
metadata:
  {
    "openclaw":
      {
        "requires": { "bins": ["npx"] },
        "install":
          [
            {
              "id": "unhuman-npm",
              "kind": "node",
              "package": "unhuman",
              "bins": ["unhuman"],
              "label": "Install unhuman CLI (npm)",
            },
          ],
      },
  }
---

# unhuman — Domain Management CLI

Register and manage domains at [unh

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The skill repeatedly invokes npx unhuman without pinning an exact package version, so execution depends on whatever version npm resolves at runtime. That creates a supply-chain risk: a compromised upstream package, malicious new release, or dependency confusion event could cause arbitrary code execution in the agent environment.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

Using npx unhuman without a pinned version allows code fetched at execution time to change unexpectedly. In a skill that can manage domains and trigger payments, arbitrary code execution could lead to domain takeover actions, token theft, or unauthorized wallet interactions.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

This command relies on npx to fetch and run the latest matching unhuman package at runtime, which is unsafe in an automated agent context. If the package or one of its dependencies is compromised, the attacker gains code execution with access to local files and any available credentials.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The unpinned npx unhuman invocation is especially risky here because the command performs domain registration and may handle payment flow or sensitive recovery details. A malicious package update could alter registration targets, exfiltrate emails or tokens, or trigger unintended actions.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding

This unpinned invocation is paired with the --wallet flag, enabling autonomous payment through agent-wallet. If npm serves a malicious or compromised unhuman release, it could execute arbitrary code and potentially abuse wallet access, exfiltrate sensitive data, or initiate unauthorized spend attempts.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

An unversioned npx execution for domain info still exposes the environment to arbitrary code execution if the package supply chain is compromised. Even seemingly read-only commands can be abused to steal local tokens, wallet metadata, or other agent secrets.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

This unpinned command modifies DNS records, so compromise of the resolved package could directly enable domain hijacking, traffic interception, or redirection to attacker infrastructure. Because management tokens are stored locally, arbitrary code execution could also steal the credentials needed for persistent abuse.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The unpinned npx unhuman command here updates nameservers, which can fully redirect control of a domain's resolution path. If the package supply chain is compromised, an attacker could silently repoint domains or steal the locally stored management token used for later abuse.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

Unpinned runtime package execution on a renewal operation allows arbitrary code execution through the npm supply chain. In context, that could lead to token theft, manipulation of renewal requests, or misuse of available wallet/payment context.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding

This invocation combines an unpinned package with --wallet, creating elevated financial risk if the package or dependency chain is compromised. A malicious update could execute arbitrary code, tamper with renewal/payment logic, or abuse wallet-integrated flows while appearing to perform a legitimate renewal.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The recovery command is executed via unpinned npx, exposing sensitive account-recovery workflows to supply-chain compromise. An attacker-controlled package could exfiltrate recovery emails, alter recovery targets, or harvest locally stored tokens and other secrets.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

This unpinned recovery flow includes a verification code, increasing the sensitivity of the operation. If a malicious package version is executed, it could capture recovery codes and use them to take over domain management or facilitate broader account compromise.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

Even listing stored tokens via an unpinned npx package is dangerous because the resolved package can execute arbitrary code before returning output. In this skill, local management tokens are highly sensitive and could be stolen for unauthorized DNS, renewal, or nameserver changes.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The skill instructs starting npx @moneydevkit/agent-wallet without pinning a version, which exposes a wallet daemon to the same npm supply-chain risk. Because this component may manage mnemonics, keys, and live funds, compromise could lead to credential theft or unauthorized financial transactions.

Content

No source excerpt is available for this finding.