ClawHub
Back to skill

Security audit

菲菲老师亲子沟通专家

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a deprecated education skill that redirects users to a fuller skill, with no embedded code, but its unpinned install command deserves caution.

Treat this package as a redirect stub. Before running the install command, prefer a pinned and reviewed version of both the ClawHub installer and feifei-learning-commander, and review the downstream skill separately because it is outside this artifact.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:26
Finding

Unpinned Third-Party Package Execution and Unreviewed Skill Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 26–28
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code:

bash
npx clawhub@latest install feifei-learning-commander

Technical Analysis

The installation instruction invokes npx with the mutable clawhub@latest package reference. If the package is not already available locally, npx may retrieve it from the configured npm registry and execute it with the invoking user's permissions.

The latest tag is mutable and does not bind execution to a reviewed package version or integrity hash. The command also directs that package to install feifei-learning-commander, a separate skill whose contents are not included in this artifact and therefore were outside the audit scope. Consequently, following the documented command crosses two unverified supply-chain boundaries: the remotely resolved CLI package and the separately installed skill.

This is classified as insecure dependency usage rather than confirmed malicious code. The audited artifact itself contains no executable scripts or embedded payloads.

Attack Path

  1. An attacker compromises the npm account, registry distribution path, or release process associated with clawhub, or causes the mutable latest tag to resolve to an unsafe release.
  2. A user follows the installation command in SKILL.md.
  3. npx downloads and executes the remotely resolved package.
  4. The package runs with the user's local privileges and processes the request to install the unaudited feifei-learning-commander skill.
  5. Compromised CLI code or unsafe downstream skill content can perform actions permitted by the user's account.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the user running npx. Depending on those privileges and the behavior of the fetched package, the affected scope could include files and crede ...[truncated 343 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace clawhub@latest with an exact, reviewed package version.
  2. Verify the package using a trusted lockfile, registry integrity metadata, checksum, or cryptographic signature.
  3. Avoid directly executing newly downloaded packages where possible. Install and inspect the pinned CLI first, then invoke the verified local binary.
  4. Pin feifei-learning-commander to a specific reviewed version rather than relying on implicit resolution.
  5. Include or vendor the downstream skill in the review scope so its instructions, scripts, dependencies, and requested permissions can be audited before installation.
  6. Document which files, network resources, tools, and permissions the installer requires.
  7. Run installation under a least-privileged account or isolated environment and review the resulting file changes before enabling the skill.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 6)May include surrounding context.

md
---
name: feifei-parent-child-comm
version: "3.5.1"
author: "学来学去学习社 | Xue Lai Xue Qu Learning Society"
brand: "学来学去出品，必是教育精品 | Excellence in Education"
description: "【已合并】菲菲老师亲子沟通功能已整合入 feifei-learning-commander v3.5.1。请安装完整版获取学科辅导+亲子沟通全功能。| [Merged] Feifei Parent-Child Comm has been integrated into feifei-learning-commander v3.5.1. Install the full version for academic tutoring + parent-child communication."
metadata:
  clawdbot:
    emoji: "🌸"
    tags: ["菲菲老师", "Feifei Teacher", "亲子沟通", "Parent-Child Communication", "家庭教育", "Family Education", "学习主控", "Learning Commander"]
    category: 教育 | Education
---

# 🌸 菲菲老

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The metadata says this skill has been merged/deprecated, but the README still advertises it as a standalone installable skill with active features. This can mislead users into installing or trusting an outdated or unsupported package, increasing the chance of version confusion, broken behavior, or use of unmaintained content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The author and brand strings prominently prescribe Chinese-language content, and the file presents the skill identity as Chinese-first without stating that language choice is optional or limited to a China-specific audience. This can violate a language/locale policy when a skill imposes a specific language presentation without user opt-in.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The skill instructs users to run npx clawhub@latest install feifei-learning-commander, which fetches and executes the latest version of a package without pinning an exact version. If the package is compromised or a malicious update is published, users could execute unintended code during installation, and the upgrade/redirect context increases the chance they will do so without scrutiny.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The skill name, description, author branding, and tags are entirely presented in Chinese, with no indication that language selection is optional or that the skill is intentionally limited to a Chinese-speaking audience. Per the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README presents all user-facing instructions and descriptions in Chinese and does not indicate that the skill is China-specific or provide any user opt-in for language/locale. Under the policy, forcing a specific language without user choice can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

This manifest describes the skill in broad natural language but does not define any explicit trigger phrases, scope limits, or exclusion conditions. For manifest files, missing specificity about when the skill should activate can contribute to unintended invocation or routing ambiguity.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.