ClawHub
Back to skill

Security audit

DaE: Persona Context Injector

Security checks for vulnerabilities and agentic risk

Overview

This is a plain-text persona-profiling skill whose main risks are intentional personal-context sharing and an optional unpinned CLI install command.

Install through the reviewed ClawHub/OpenClaw listing when available, or verify the source and prefer pinned revisions before running the npx command. Treat generated PersonaProfiles as sensitive personal data: skip questions you do not want recorded, redact unnecessary details, and only paste the profile into downstream agents you trust.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:46
Finding

Unpinned Remote Dependencies in Documented Installation Command

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 46-50
Vulnerability Type: Unpinned third-party CLI and mutable GitHub dependency
Risk Level: Medium

Vulnerable Code

markdown
Skills CLI:

```bash
npx skills add https://github.com/sirsws/dae-persona-context-injector --skill dae-persona-context-injector
text

### Technical Analysis

The documented installation command invokes the `skills` package through `npx` without specifying a reviewed package version. It also installs the Skill from a GitHub repository URL without pinning the source to an immutable commit hash or signed release.

As a result, the code retrieved when a user runs this command may differ from the code reviewed during this audit. `npx` can download and execute package code, while a repository's default branch can be modified after publication. Compromise of the npm package, its maintainer account, the GitHub account, or the repository could therefore turn the documented installation workflow into a supply-chain execution vector.

The project does not contain evidence that this command runs automatically. Exploitation requires a user or automation system to execute the documented installation command.

### Attack Path

1. An attacker compromises the unpinned `skills` package, its publishing account, the referenced GitHub account, or the repository's mutable default branch.
2. The attacker publishes or commits a modified installer, Skill package, lifecycle script, or other executable content.
3. A user follows the installation instructions and runs the documented `npx skills add ...` command.
4. `npx` retrieves the current CLI package, and the CLI retrieves content from the mutable GitHub reference.
5. The malicious component executes during installation or installs attacker-controlled Skill content.
6. The payload operates with the permissions of the user or automation account that launched the command.

### Impact Assess
...[truncated 630 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the CLI package to a specifically reviewed version rather than allowing npx to resolve the latest release, for example by using an exact version such as npx skills@X.Y.Z.
  2. Replace the mutable GitHub repository reference with an immutable, reviewed commit hash or signed release tag.
  3. Prefer a release artifact with a published SHA-256 checksum and instruct users to verify its integrity before installation.
  4. Avoid relying on unsigned mutable branch content in installation documentation.
  5. Document the expected package publisher, repository owner, release identifier, and checksum so users can validate provenance.
  6. Review the pinned CLI and repository revision for lifecycle scripts or other installation-time execution before recommending them.
  7. Where supported, run installation in a restricted environment with least-privilege filesystem, credential, and network access.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The installation command uses npx skills add ... without pinning a specific package version, which can cause users to execute whatever version of the skills package is current at install time. If the upstream package is compromised, typo-squatted, or updated with malicious behavior, users could run unreviewed code during installation or skill management.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This skill explicitly solicits sensitive personal profiling data, structures it into a reusable persona profile, and instructs users to pass that profile to downstream agents, but it provides no privacy warning, consent language, minimization guidance, or handling restrictions. That creates a real risk of oversharing, secondary use of sensitive data, and propagation of intimate personal details across systems beyond the user's original expectation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

Line L27 states that English is the primary submission language as a fixed requirement. This is a natural-language locale policy constraint, and the file does not indicate that alternative languages are permitted or that this is a justified region-specific requirement.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.