Clawvisual

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 11:32 AM UTC
• Version: 1.0.2

Overview

This skill is a disclosed wrapper for a local carousel-generation CLI/MCP service, with ordinary but real supply-chain and API-key handling considerations.

Install only if you trust the npm package publisher and are comfortable giving the CLI an LLM API key. Prefer a pinned reviewed version or isolated environment when possible, and avoid using the raw call command with untrusted tool names or arguments.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:3

Finding

Unpinned Third-Party npm Package Executes Unreviewed Code

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 3 and 13
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

yaml

metadata: {"clawdbot":{"emoji":"🖼️","requires":{"bins":["clawvisual"]},"install":[{"id":"npm","kind":"npm","package":"clawvisual","bins":["clawvisual"],"label":"Install clawvisual (npm)"}]}}

bash

npm install -g clawvisual

Technical Analysis

The Skill installs the third-party clawvisual npm package without specifying an exact version or integrity hash. The package's source code, package manifest, and lockfile are not included in the audited project, so its installation hooks and runtime behavior cannot be verified from the available artifact.

Running npm install -g clawvisual resolves whichever package version is current under that npm package name. npm packages may execute package-controlled lifecycle scripts during installation and install executable commands. The global installation scope also makes the resulting command available outside this individual Skill invocation.

This creates a supply-chain exposure: a compromised maintainer account, malicious package release, or unexpected future package update could alter the code executed by users without requiring any change to SKILL.md. The documentation later directs users to provide API keys to this unaudited executable, increasing the potential sensitivity of a compromised dependency.

The audit found no evidence that the current package is malicious. The issue is the Skill's unpinned and unverifiable trust in an externally maintained executable dependency.

Attack Path

1. An attacker compromises the npm package, its maintainer account, or its release process and publishes a malicious version under the clawvisual package name.
2. A user or Agent follows the installation instruction in SKILL.md:

   bash

   npm install -g clawvisual
   

3. npm resolves ...[truncated 1159 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an exact, reviewed version rather than resolving the latest release:

   bash

   npm install --global clawvisual@<reviewed-exact-version>
   

2. Record and verify the expected package integrity digest through a lockfile or an equivalent trusted verification mechanism.
3. Prefer a project-local installation over a global installation to reduce command replacement and cross-project exposure.
4. Review and retain the source code and package metadata corresponding to the pinned release.
5. Disable npm lifecycle scripts during installation with --ignore-scripts unless they are demonstrably required. If scripts are required, audit each script before permitting execution.
6. Pin the package by immutable artifact or commit and establish a controlled update process requiring security review.
7. Document the expected network endpoints, local credential-storage behavior, and file permissions used by the CLI.
8. Store API keys using an operating-system credential manager or another protected secret store rather than plaintext configuration, if supported.
9. Run the CLI with least privilege and restrict filesystem and network access where practical.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

MCP Config Access

High

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

md

- `clawvisual initialize`: probe/start local service and print Web URL.
- `clawvisual status`: check service identity (must be `clawvisual`).
- `clawvisual tools`: list MCP tools.
- `clawvisual convert --input <text_or_url> [--slides auto|1-8] [--ratio 4:5|1:1|9:16|16:9] [--lang <code>]`
- `clawvisual status --job <job_id>`: query job state and result.
- `clawvisual revise --job <job_id> --instruction <text> [--intent rewrite_copy_style|regenerate_cover|regenerate_slides]`