ClawHub
Back to skill

Security audit

cpbox-spellcheck

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent paid spellcheck helper, but it tells users to run an unpinned payment tool through npx in a wallet-backed flow.

Before installing or using this skill, verify and pin the `@springmint/x402-payment` package version, review the x402 setup instructions, use a wallet with strict spending limits, and require clear confirmation of payment destination and amount for each request.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Error
Location
SKILL.md:48
Finding

Unpinned Payment Package Executed Through npx

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 48–52
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: High

bash
npx @springmint/x402-payment \
  --url "https://www.cpbox.io/api/x402/spellcheck?q=artifical%20inteligence&lang=en&country=US" \
  --method GET

Technical Analysis

The documented command executes @springmint/x402-payment through npx without specifying an exact version, integrity hash, lockfile, or other immutable package reference. If the package is not already installed locally, npx can retrieve and immediately execute the package version currently resolved by the package registry.

This creates a supply-chain risk because the code executed by users can change after the skill has been reviewed. Compromise of the package publisher, registry account, release process, or package itself could cause arbitrary attacker-controlled code to run locally. The exposure is especially sensitive because the package is intended to perform wallet-backed payment signing.

Attack Path

  1. An attacker compromises the package publisher account, package distribution process, or a mutable package release.
  2. The attacker publishes a malicious version under @springmint/x402-payment.
  3. A user follows the documented command without pinning a previously audited version.
  4. npx resolves, downloads, and executes the malicious package.
  5. The package runs with the invoking user's privileges and can attempt to access files, environment variables, wallet interfaces, credentials, and reachable network services.
  6. Any accessible sensitive data may be exfiltrated, or wallet-backed operations may be manipulated subject to the wallet's own authorization controls.

Impact Assessment

Successful exploitation provides arbitrary code execution with the privileges of the user running npx. The affected scope can include files readable or writable by that user, envi ...[truncated 310 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin the dependency to an exact, reviewed version, for example @springmint/x402-payment@X.Y.Z, rather than allowing mutable version resolution.
  • Install the dependency through a committed lockfile and use a reproducible installation mechanism such as npm ci.
  • Verify package provenance, registry identity, release signatures, and integrity metadata before execution.
  • Avoid downloading and executing payment-related tooling in a single command. Document a separate verification and installation step.
  • Run the payment client in a sandbox or restricted environment with minimum filesystem and network access.
  • Keep wallet keys outside the process environment where possible and require explicit user confirmation, transaction limits, and destination validation for every signature.
  • Document the expected package version and cryptographic digest so users can detect unexpected release changes.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The documentation instructs users to run npx @springmint/x402-payment without pinning an exact package version. This can cause users to fetch and execute whatever package version is current at runtime, increasing supply-chain risk if a future release is compromised, maliciously updated, or unexpectedly changed. In this skill context, the risk is somewhat elevated because the package participates in a payment-signing workflow, so compromise could affect wallet operations or transaction handling.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.