ClawHub
Back to skill

Security audit

Image Generation Test

Security checks for vulnerabilities and agentic risk

Overview

This is a visible placeholder skill that only tells users how to install another image-generation skill, with a supply-chain caution because the install command is unpinned.

Install only if you trust the ClawHub CLI source and the JaredforReal/glm-image-gen skill. Prefer a pinned or verified installer/version when available, and review the target skill before enabling it in an environment with sensitive files or credentials.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:12
Finding

Unpinned Remote Skill and CLI Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12–17
Vulnerability Type: Supply-chain risk from mutable third-party components
Risk Level: Medium

markdown
**[GLM-Image-Generation](https://clawhub.ai/JaredforReal/glm-image-gen)**

```bash
npx clawhub@latest install JaredforReal/glm-image-gen
text

### Technical Analysis

The installation command uses the mutable `latest` version of the `clawhub` npm package and installs a remotely maintained Skill without pinning either component to an immutable version or integrity digest. The reviewed project does not contain the external Skill's implementation, so its effective behavior cannot be verified from this repository.

The linked Skill is described as official, but the document provides no signature, checksum, immutable release identifier, or other locally verifiable provenance. Changes to either the npm package or remote Skill can therefore alter what users download and execute after this project has been reviewed.

### Attack Path

1. A user follows the installation guidance in `SKILL.md`.
2. `npx` resolves and downloads the current package published under `clawhub@latest`.
3. The downloaded CLI executes with the privileges of the invoking user.
4. The CLI retrieves the mutable `JaredforReal/glm-image-gen` Skill from an external service.
5. If either upstream component has been compromised, replaced, or maliciously updated, attacker-controlled behavior may be installed or executed without being represented in this audited repository.
6. The installed Skill may subsequently operate with the tools and permissions granted to the hosting agent.

Exploitation depends on compromise or malicious modification of an upstream package, publisher account, distribution service, or remote Skill release.

### Impact Assessment

A compromised CLI can act with the operating-system privileges of the user running `npx`. A compromised installed Skill can act with
...[truncated 429 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin the clawhub CLI to a specifically reviewed version instead of using @latest.
  • Pin the target Skill to an immutable release, commit, or content digest.
  • Publish and verify cryptographic checksums or signed release metadata before installation.
  • Document verifiable publisher provenance rather than relying solely on an “official” designation.
  • Download and inspect the external Skill before enabling or executing it.
  • Perform installation in a sandbox or least-privileged environment without access to sensitive credentials or files.
  • Establish a controlled update process that requires security review before changing pinned versions.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The skill instructs users to run npx clawhub@latest install JaredforReal/glm-image-gen, which relies on a floating latest package version instead of a pinned version. This creates a supply-chain risk: if the published package changes, is compromised, or behaves differently over time, users may execute unexpected code during installation. The placeholder nature of the skill makes this somewhat less suspicious in intent, but it still directs users to an unpinned executable installer.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest description and the visible README content are entirely in Chinese, which imposes a specific language on users without any opt-in or alternative locale. The policy for natural-language violations applies to all file types and calls for flagging language or locale constraints that are not optional or justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.