Blogwatcher

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 4:12 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward wrapper for installing and using a blog/RSS monitoring CLI, with the main caveat that it installs the CLI from a mutable Go module version.

Before installing, consider pinning blogwatcher to a specific reviewed version instead of @latest, and install it only in an environment where the CLI does not inherit unnecessary secrets or sensitive filesystem access.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:6

Finding

Unpinned Third-Party Go Dependency Installed from a Mutable Source

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 6 and 14
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Complete Code Snippet:

yaml

metadata: {"clawdbot":{"emoji":"📰","requires":{"bins":["blogwatcher"]},"install":[{"id":"go","kind":"go","module":"github.com/Hyaxia/blogwatcher/cmd/blogwatcher@latest","bins":["blogwatcher"],"label":"Install blogwatcher (go)"}]}}

markdown

- Go: `go install github.com/Hyaxia/blogwatcher/cmd/blogwatcher@latest`

Technical Analysis

Both installation declarations use the mutable @latest selector for a third-party Go module. Consequently, the installed source is determined at installation time rather than being tied to a version that was reviewed with this skill.

If the upstream repository, release process, maintainer account, or module distribution path is compromised, @latest can resolve to a malicious future release. The resulting executable would then be trusted under the legitimate blogwatcher name. The skill does not specify an audited version, verify an expected checksum independently, or otherwise constrain the installed artifact to the implementation reviewed by the skill author.

Attack Path

1. An attacker compromises the upstream repository, a maintainer account, or its release process.
2. The attacker publishes a newer malicious version of github.com/Hyaxia/blogwatcher/cmd/blogwatcher.
3. A user or agent follows the skill installation metadata or documented command.
4. Go resolves @latest to the attacker-controlled version and installs it as blogwatcher.
5. The user or agent invokes a documented command such as blogwatcher scan.
6. The malicious executable runs with the privileges and environment of that user or agent.

Impact Assessment

Successful exploitation can execute attacker-controlled behavior with the privileges of the account running blogwatcher. Depending on that account's ...[truncated 382 chars]

Remediation

View remediation

Remediation Suggestions

• Replace @latest in both installation declarations with a specific, reviewed semantic version, for example:

  bash

  go install github.com/Hyaxia/blogwatcher/cmd/blogwatcher@vX.Y.Z
  

• Update the metadata module field to use the same pinned version so automated and manual installation paths remain consistent.

• Review the source and dependency graph of the selected release before pinning it.

• Use Go's checksum database and module verification, and consider independently validating release provenance or a known artifact digest.

• Introduce a controlled dependency-update process that reviews and tests each new version before changing the pin.

• Run the installed CLI under a least-privileged account and avoid exposing unnecessary secrets in its environment.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.