ClawHub
Back to skill

Security audit

cpbox-images-search

Security checks for vulnerabilities and agentic risk

Overview

This image-search skill is mostly coherent, but it asks users to run an unpinned payment-signing helper through npx, which creates a review-worthy supply-chain and payment-control risk.

Install only if you are comfortable using this paid image-search provider and its x402 payment helper. Prefer a pinned, reviewed version of @springmint/x402-payment, run it with limited payment credentials and spending caps, and confirm paid requests before allowing automatic signing.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:46
Finding

Unpinned Third-Party Package Download and Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 46-49
Vulnerability Type: Unpinned third-party dependency executed through npx
Risk Level: Medium

Vulnerable Code:

bash
npx @springmint/x402-payment \
  --url "https://www.cpbox.io/api/x402/images-search?q=mountain+landscape&count=20" \
  --method GET

Technical Analysis

The documented workflow invokes @springmint/x402-payment through npx without specifying a package version, integrity hash, or reviewed lockfile. If the package is not already available locally, npx may retrieve the current release from the configured npm registry and immediately execute it.

The effective executable code can therefore change after the Skill has been reviewed. The audited project does not contain the package implementation, a dependency manifest, or a lockfile through which its exact contents and integrity could be verified. This creates a third-party software supply-chain risk.

The package is also documented as handling automatic payment signing. Consequently, compromise or malicious modification of the package could affect both the local execution environment and payment-related credentials or requests.

Attack Path

  1. An attacker compromises the npm package, its publisher account, its dependency chain, or the registry resolution path.
  2. The attacker publishes or causes resolution to a malicious release of @springmint/x402-payment.
  3. A user or agent follows the command documented in SKILL.md.
  4. npx downloads the mutable, unpinned package release.
  5. The downloaded package executes with the permissions and environment of the invoking process.
  6. Malicious code could inspect accessible payment credentials, alter payment operations, read or modify accessible files, or initiate unrelated network requests.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the invoking user's privilege ...[truncated 503 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin @springmint/x402-payment to a specific, reviewed version rather than allowing npx to resolve the latest release.
  2. Declare the dependency in a package manifest and commit a lockfile containing registry and integrity metadata.
  3. Install dependencies separately using a reproducible, frozen-lockfile workflow; invoke the verified local binary instead of permitting ad hoc downloads during Skill execution.
  4. Verify package provenance, signatures, publisher identity, and integrity before installation.
  5. Audit the pinned package and its transitive dependencies, and use automated dependency monitoring for later security advisories.
  6. Run payment tooling in a sandbox or restricted account with minimum filesystem and network permissions.
  7. Use isolated payment credentials with explicit per-transaction and aggregate spending limits.
  8. Require clear user confirmation before signing or submitting any payment.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The documentation instructs users to run npx @springmint/x402-payment without a pinned version, which causes retrieval and execution of whatever package version is current at runtime. If the package is compromised, typosquatted, or updated maliciously, users or agents could execute unreviewed code, and in this skill's context that code may also gain access to payment credentials or signing flows used by x402.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The parameter table sets country to US and search_lang to en as defaults, which bakes in a specific locale choice in the natural-language documentation. Because the file does not present this as a user-selectable preference or justify the locale restriction as region-specific, it may violate locale-choice policy expectations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.