ClawHub
Back to skill

Security audit

Tractusx EDC

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward reference skill for manually running Tractus-X EDC control-plane API commands, but users should treat its API key and mutating examples carefully.

Install only from a trusted ClawHub installer version, configure the control-plane URL deliberately, use least-privilege EDC credentials, and review every curl payload before running commands that delete resources, initiate transfers, or expose EDR data addresses.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:8
Finding

Mutable Package Execution in Installation Instructions

Content
View full analysis

Vulnerability Details

File Location: README.md, line 8
Vulnerability Type: Supply-chain risk caused by executing an unpinned dependency
Risk Level: Medium

Vulnerable Code

bash
npx clawhub@latest install tractusx-edc-v3

Technical Analysis

The installation command uses npx to retrieve and execute the mutable latest release of the third-party clawhub package. Because neither an exact version nor an integrity digest is specified, the code executed by this command can change after the Skill has been reviewed.

This creates a time-of-check/time-of-use supply-chain risk. If the package publisher account, registry, package, or release process is compromised, an attacker can publish a modified version under the latest tag. A user following the documented installation procedure would then retrieve and execute that version without assurance that it is the version evaluated during this audit.

Attack Path

  1. An attacker compromises the clawhub package, its publisher credentials, or its distribution channel.
  2. The attacker publishes a malicious release and assigns or causes it to receive the latest tag.
  3. A user runs the installation command from README.md.
  4. npx downloads the attacker-controlled package release.
  5. The package executes with the privileges of the user running the command.
  6. The malicious package may perform any operation permitted to that user before, during, or after installing the Skill.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the installing user's privileges. Depending on that user's permissions and environment, the affected scope could include:

  • Reading or modifying files accessible to the user.
  • Accessing environment variables and locally available credentials.
  • Altering the installed Skill or other user-owned tools and configuration.
  • Making network requests from the host.
  • Establishing additional persistence where the user's permissi ...[truncated 210 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace the mutable tag with an exact, reviewed package version:
bash
npx clawhub@X.Y.Z install tractusx-edc-v3
  1. Verify the selected package version's provenance, publisher, release signatures, and registry integrity metadata before recommending it.
  2. Where supported, enforce an integrity digest or checksum so installation fails if the retrieved artifact differs from the reviewed artifact.
  3. Document a trusted registry explicitly and prevent fallback to untrusted or unexpected package sources.
  4. Review new versions before updating the documented pin rather than automatically tracking latest.
  5. Consider installing the tool through a lockfile-backed workflow or another mechanism that records and verifies the complete dependency graph.
  6. Advise users to run installation with the minimum required privileges and not from an administrator or root account.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (6)

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The installation command uses npx clawhub@latest, which pulls and executes the most recent package version without pinning. This creates a supply-chain risk: a compromised upstream release or unexpected breaking change could cause users to run unreviewed code during installation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The README advertises destructive capabilities such as creating, updating, deleting assets, managing contract definitions, and initiating transfers, but does not warn users about the operational and security consequences. In a skill that issues curl commands against a live control-plane API, missing safety guidance increases the chance of accidental destructive actions against production connectors or sensitive data-sharing workflows.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

Create Asset:

bash
curl -X POST "${EDC_CONTROL_PLANE_URL}/v3/assets" \
  -H "Content-Type: application/json" \
  -H "X-Api-Key: ${EDC_API_KEY}" \
  -d '{

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The markdown includes deletion commands such as deleting an asset, but it does not warn that these actions may remove connector resources or have irreversible effects. Under the markdown-file criteria, destructive behaviors that affect user data or system integrity should be accompanied by clear warnings.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The transfer-process and EDR examples initiate data movement and retrieve data addresses, but the documentation does not disclose that these actions may transmit business data to external endpoints or expose access details. For markdown files, behaviors affecting privacy or system integrity should be clearly warned about.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The configuration section instructs users to set EDC_API_KEY, but it does not include any warning about treating it as a secret or avoiding accidental disclosure in shells, logs, or shared examples. Since the skill behavior involves authentication material, a brief credential-handling warning is warranted in markdown.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.