ClawHub
Back to skill

Security audit

Eightctl

Security checks for vulnerabilities and agentic risk

Overview

This skill is a small, disclosed wrapper for controlling Eight Sleep pods through the eightctl CLI, with a supply-chain caution because it installs the CLI from a mutable latest reference.

Install this only if you are comfortable using an unofficial third-party CLI with your Eight Sleep account credentials and device controls. Prefer a pinned/reviewed eightctl version, protect the config file and EIGHTCTL_* environment variables, and require explicit confirmation before any command that changes temperature, alarms, schedules, power state, audio, or base position.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:5
Finding

Unpinned Third-Party CLI Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 5
Vulnerability Type: Supply-chain risk caused by a mutable dependency reference
Risk Level: Medium

yaml
metadata: {"clawdbot":{"emoji":"🎛️","requires":{"bins":["eightctl"]},"install":[{"id":"go","kind":"go","module":"github.com/steipete/eightctl/cmd/eightctl@latest","bins":["eightctl"],"label":"Install eightctl (go)"}]}}

Technical Analysis

The installation metadata retrieves github.com/steipete/eightctl/cmd/eightctl@latest. The @latest reference is mutable and does not identify the exact source revision that was reviewed. Consequently, an installation performed later can download and execute code that differs from the version available at audit time.

The referenced implementation is not included in the audited project, so its behavior could not be independently verified. Although using a public Go module is not inherently malicious, relying on its latest release without an immutable version, commit, checksum policy, or signature verification creates a supply-chain exposure. A compromised upstream repository, maintainer account, release process, or future malicious release could introduce arbitrary executable behavior.

Attack Path

  1. An attacker compromises the upstream repository, a maintainer account, or the release process, or otherwise causes a malicious version to become the module's latest release.
  2. A user or agent installs the required tool through the Skill metadata.
  3. The Go installer resolves @latest to the attacker-controlled version.
  4. The resulting eightctl binary executes with the installing user's privileges when the Skill invokes commands such as eightctl status.
  5. The malicious binary can access resources available to that user, potentially including environment variables and the documented Eight Sleep configuration at ~/.config/eightctl/config.yaml.

Impact Assessment

Successful exploitation could pr ...[truncated 446 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace @latest with a specific, reviewed semantic version or immutable commit identifier.
  • Record and verify the expected module checksum through Go's checksum mechanisms and a trusted module source.
  • Review the pinned dependency source and its transitive dependencies before approving updates.
  • Adopt a controlled dependency-update process that performs security review and testing before changing the pinned version.
  • Where supported, verify signed releases or provenance attestations and distribute a reproducibly built, checksum-verified binary.
  • Run the CLI with least privilege and limit its access to unrelated files, secrets, and environment variables.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.