ClawHub
Back to skill

Security audit

Pinme Share

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real PinMe/IPFS sharing tool, but it needs review because it can publish local files permanently and auto-install an unpinned npm CLI at runtime.

Install only if you are comfortable with a skill that can read chosen local files or directories, upload them to public IPFS, store a PinMe AppKey locally, and install the PinMe npm CLI on first use. Confirm every upload target yourself, avoid private or credential-bearing files, and consider preinstalling or pinning the PinMe CLI instead of relying on runtime npm installation.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (7)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
stderr("ℹ️  pinme CLI not found, installing via npm...")
    npm_global = os.path.expanduser("~/.npm-global")
    try:
        r = subprocess.run(
            ["npm", "install", "-g", "pinme", "--prefix", npm_global],
            capture_output=True, text=True, timeout=180,
        )
Confidence
94% confidence
Finding
The script automatically performs a global `npm install -g pinme`, which executes untrusted third-party package installation code on the host. In a skill whose stated purpose is file upload/link sharing, silently adding software and running installer scripts materially expands the execution surface and could lead to supply-chain compromise or unexpected code execution.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
return False, f"npm install failed: {e}"
    if r.returncode != 0:
        try:
            r2 = subprocess.run(
                ["npm", "install", "-g", "pinme"],
                capture_output=True, text=True, timeout=180,
            )
Confidence
94% confidence
Finding
This fallback also performs an unpinned global npm installation, again allowing package lifecycle scripts and fetched code to execute on the machine. As a second installation path, it increases the chance that the skill will execute external code outside the minimal upload function advertised to users.

Lp3

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding
The skill clearly performs privileged actions (reads local files, writes an AppKey file, reads environment variables, and invokes shell/npm tooling) but does not declare permissions. This creates a transparency and policy-enforcement gap: an agent may invoke the skill without explicit user/system approval for those capabilities, increasing the chance of unintended file exfiltration or secret handling.

Description-Behavior Mismatch

Medium
Confidence
96% confidence
Finding
The skill description emphasizes upload/share/history, but the code also exposes account-affecting operations like deletion, logout, wallet inspection, and AppKey management. This capability mismatch is dangerous because an agent or user may invoke the skill expecting limited behavior while the script can modify remote state or reveal account metadata.

Context-Inappropriate Capability

Medium
Confidence
98% confidence
Finding
Automatically installing the PinMe CLI via npm is an extra code-execution capability not required for merely uploading a provided file when dependencies should be managed beforehand. In an agent skill context, this can cause unexpected host mutation and supply-chain exposure, especially because npm packages can run install scripts.

Vague Triggers

Medium
Confidence
89% confidence
Finding
The trigger phrases are broad enough to match routine requests like 'upload this file', 'give me a public link', or 'show my upload history', which can cause over-eager activation in contexts where the user did not intend a public IPFS upload. Because this skill publishes data to a world-readable, effectively undeletable medium, accidental invocation materially raises the risk of irreversible data exposure.

Unsafe Defaults

Medium
Category
Tool Misuse
Content
## ⚠️ Public-data warning

PinMe = public IPFS. Anything you upload is **world-readable** and **practically undeletable**
(third-party IPFS nodes cache content). **Never upload** internal docs, client data, credentials,
private info, or unreleased material. The script prints a stderr warning on every upload; pass
`--yes` to silence it in automation.
Confidence
88% confidence
Finding
The skill’s core function is to upload arbitrary local files or directories to a public IPFS pinning service, making content world-readable and difficult to retract. Even though the README includes a warning, the capability is inherently risky in an agent context because users or downstream automation may accidentally publish secrets, internal documents, or personal data; the presence of a '--yes' flag to silence warnings further lowers friction for unsafe disclosure.

Static analysis

No suspicious patterns detected.