clawgrep

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:34 AM UTC
• Version: 0.1.4

Overview

This is a coherent local semantic-search skill, with disclosed cache and first-run model download behavior but some ordinary supply-chain caution around unpinned installation commands.

Before installing, confirm you trust the clawgrep publisher and package source, prefer a pinned or reviewed release in controlled environments, and remember that the first run contacts Hugging Face and writes a local cache. Search only the directories you intend to index, especially when working with private notes or repositories.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:10

Finding

Unpinned Package Installation and Unverified Runtime Model Download

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10–13 and 31–40
Vulnerability Type: Supply-chain risk from unpinned dependencies and an unverified runtime artifact
Risk Level: Medium

Vulnerable Code Snippet

yaml

compatibility: >
  Requires the clawgrep binary on PATH. Works on Linux, macOS, and Windows.
  No API keys needed. On first run, downloads a small ONNX embedding model
  (~30 MB) from Hugging Face and caches it locally. Subsequent runs are
  fully offline. Install via cargo, npm, or pip.

markdown

If not found, install from the [open-source repository](https://github.com/Schonhoffer/clawgrep) using any of these methods (only one needed):

```bash
cargo install clawgrep         # Rust (recommended)
npm install -g clawgrep        # Node.js
pip install clawgrep           # Python

text

### Technical Analysis

The documented installation commands resolve `clawgrep` by package name without pinning an exact reviewed version or requiring a lockfile, checksum, package signature, or provenance verification. Although the surrounding text links to a source repository, these commands install artifacts from the Cargo, npm, and Python package registries rather than directly verifying content against that repository.

The Skill also states that the installed executable downloads an ONNX model from Hugging Face on its first run. The documentation does not identify an immutable model revision, artifact filename, or expected cryptographic digest. Consequently, the effective component used at runtime can differ from what was reviewed.

This is a supply-chain weakness rather than evidence that the current packages or model are malicious. Exploitation requires compromise, replacement, or deceptive publication of one of the externally resolved artifacts.

### Attack Path

1. An attacker compromises a relevant registry publisher account, distribution process, or model-hosting artifact, or succeeds in publishing a deceptive package thro
...[truncated 1520 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin each installation method to a specific reviewed release rather than resolving the latest package:
   • Use an exact Cargo version with locked dependency resolution where supported.
   • Use an exact npm version and document the expected integrity/provenance information.
   • Use an exact Python version with hashes, such as a hash-locked requirements file.
2. Publish and document cryptographic SHA-256 digests or verifiable signatures for release artifacts.
3. Document the official publisher identity for every registry so users can detect similarly named or unauthorized packages.
4. Prefer reproducible builds or signed release binaries obtained from a trusted, immutable release.
5. Pin the Hugging Face model to an immutable repository revision or commit and specify the exact artifact filename and expected digest.
6. Verify the model digest before loading it and reject mismatches. Download to a temporary file, validate it, and only then atomically move it into the cache.
7. Avoid global or elevated installation unless it is strictly necessary. Recommend isolated user-level environments or containers with least-privilege filesystem and network access.
8. Document cache ownership and permission requirements so other local users cannot replace cached artifacts.
9. Add a controlled update procedure requiring review and digest updates whenever the package or model version changes.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This markdown file documents that the tool 'automatically downloads a small ONNX embedding model' and caches it locally, which is behavior that affects network usage and local system state. Although the behavior is mentioned, there is no explicit user-facing warning about contacting an external service on first run or writing to the local cache directory.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This is a markdown file, so SQP-2 applies to missing warnings in the skill description. The text mentions the download behavior, but it does not clearly warn users that invoking the tool causes an external network request to Hugging Face on first run, which has privacy and environment implications.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.