T08 · Insecure Dependencies
Warning
- Location
SKILL.md:11- Finding
Unpinned npm Package Execution Through npx
- Content
View full analysis
- Remediation
View remediation
Security audit
GreenClaw
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly coherent for usage analytics, but it repeatedly tells agents to run an unpinned external CLI that can change at runtime and can modify budget-alert settings.
Review before installing. Use this only with a pinned, trusted GreenClaw CLI or a locally installed version from a locked dependency set, and require confirmation before allowing an agent to create or remove alert rules. Limit the telemetry database path to the intended GreenClaw data and avoid exposing unrelated credentials or files to the command environment.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (22)
External Model or Provider Selection
High
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
- Content
Set a per-model cost cap:
bash npx greenclaw alerts set --name "gpt-4 cap" --metric per_model_cost --threshold 30 --unit usd --period day --model gpt-4Check alerts now:
External Model or Provider Selection
High
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
- Content
bash npx greenclaw traces --tier HEARTBEAT npx greenclaw traces --model gpt-4o-miniHow to Present Results
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The skill repeatedly instructs the agent to execute
npx greenclawwithout a pinned package version, which can cause retrieval and execution of whatever package version is current at runtime. If the package is updated maliciously, compromised upstream, or typosquatted in the registry, the agent could run attacker-controlled code during routine analytics operations.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
This command uses
npx greenclawwithout a fixed version, creating a supply-chain execution risk each time the skill is used. Becausenpxmay fetch code at execution time, an attacker controlling the package release path could gain code execution in the agent environment.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The skill recommends running an unpinned package through
npx, which is a classic supply-chain risk because the resolved artifact can change over time. In an agent context, that can turn a benign reporting action into arbitrary code execution with access to local files, credentials, or network resources.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
Running
npx greenclawwithout version pinning leaves the execution target mutable and dependent on the state of the external package registry. That makes the skill vulnerable to malicious releases or dependency compromise, especially dangerous for automated agents that may execute commands without human review.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
This unpinned
npxinvocation introduces the same remote package execution risk as the other command examples. A compromised package could abuse the agent's environment while appearing to perform harmless usage breakdown reporting.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The command relies on
npx greenclawwithout fixing the resolved version, allowing unexpected code changes over time. In practice this exposes the skill to registry compromise, malicious maintainer updates, or typo-squatted package substitution.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
Because
npx greenclawis not pinned, the command may execute different code on different runs depending on upstream package state. That undermines trust and can enable arbitrary code execution under the guise of querying provider cost data.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
This example performs a runtime package execution through
npxwithout a fixed version, which is a meaningful supply-chain vulnerability. The analytics context does not reduce the risk because the invoked package still executes locally with whatever privileges the agent has.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
Unpinned
npxexecution means the command trusts the current registry state at runtime, which may be attacker-influenced. That is dangerous in an automated skill because a package update can silently transform a read-only alert listing operation into arbitrary local code execution.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The skill continues to use a floating
npx greenclawcommand, preserving a consistent supply-chain risk across alert-management operations. If exploited, an attacker could execute arbitrary code and potentially tamper with usage data, alert settings, or other local assets.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
This command both performs a state-changing action and invokes an unpinned package from
npx, increasing the blast radius if the package is compromised. A malicious release could not only execute code but also alter budgeting configuration or exfiltrate telemetry database contents.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The unversioned
npx greenclawinvocation remains vulnerable to upstream package compromise or unexpected behavior drift. Since this command changes weekly budgeting rules, a malicious or broken package could both run arbitrary code and persist unauthorized configuration changes.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
This state-changing command is executed via an unpinned
npxpackage, making the skill susceptible to supply-chain attacks at the moment of use. The presence of model-specific parameters does not create the core issue; the risk is arbitrary code execution through a mutable external package.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
Even for a seemingly harmless alert check,
npx greenclawwithout version pinning allows execution of whatever code the registry currently serves. That gives attackers a route to compromise hosts that use the skill for routine monitoring.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The alert history command uses an unpinned
npxpackage, exposing the environment to untrusted code execution despite the command being read-only in intent. The vulnerability is especially relevant for agents because users may assume documentation examples are safe to automate.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
This command removes persisted alert rules while also relying on a floating
npxpackage, combining supply-chain risk with destructive capability. A compromised package could abuse the delete-oriented workflow to hide billing controls or perform broader system changes.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The traces stats command still executes
npx greenclawwithout a version, which means an external registry can influence code run in the local environment. Telemetry inspection may involve sensitive usage data, so compromise could lead to data exposure in addition to code execution.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
This example again instructs use of an unpinned
npxpackage, preserving the same supply-chain attack surface. Filtering traces by tier does not mitigate the underlying risk of arbitrary code execution from a mutable package source.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The command at this line uses
npx greenclawwithout version pinning, allowing the exact executed code to vary with upstream registry state. Because the skill processes telemetry and model-related metadata, exploitation could expose sensitive operational information or alter results.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The documentation includes commands that set and remove alert rules but does not clearly warn that these operations persistently modify alert configuration. In an agent skill, that can cause unintended state changes, surprise billing-monitoring behavior, or accidental deletion of safeguards if commands are executed automatically.
- Content
Static analysis
No suspicious patterns detected.