French Daily Drill

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:25 AM UTC
• Version: 1.0.0

Overview

This is a simple French practice prompt skill with no bundled code or hidden runtime behavior, though its README uses an unpinned install command.

Before installing, prefer a pinned or verified ClawHub installer version if available. Expect the skill to produce French drills with English support text by default, and avoid storing your level in memory unless you are comfortable saving that preference.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:37

Finding

Unpinned Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: README.md, line 37
Vulnerability Type: Execution of a mutable third-party package release
Risk Level: Medium

bash

npx clawhub@latest install tetsuakira-vk/french-daily-drill

Technical Analysis

The documented installation command instructs users to download and execute the package currently associated with the mutable latest tag. Because no reviewed version or integrity value is specified, the code executed by npx can change after this project has been audited.

This creates a supply-chain trust boundary outside the reviewed project. If the package registry, publisher account, package, or release process is compromised, an attacker could publish a malicious version under latest. A user following the documentation would then download and execute that version without an opportunity to compare it against a known-good release.

The command also installs the skill by a mutable repository identifier rather than an explicitly reviewed version, commit, or artifact digest. The audited project itself contains no malicious scripts; the risk arises from the unpinned installation path documented in the README.

Attack Path

1. An attacker compromises the clawhub package, its publisher account, or the relevant package-distribution infrastructure.
2. The attacker publishes a malicious package release and assigns it the latest distribution tag.
3. A user follows the installation instructions and runs npx clawhub@latest install tetsuakira-vk/french-daily-drill.
4. npx retrieves and executes the attacker-controlled package in the user's environment.
5. The malicious package performs actions with the permissions of the invoking user, such as reading accessible files, stealing environment credentials, modifying user configuration, or installing additional payloads.

Exploitation depends on compromise or malicious control of the external distribution channel; no dir ...[truncated 611 chars]

Remediation

View remediation

Remediation Suggestions

• Replace clawhub@latest with a specific, reviewed version, for example clawhub@X.Y.Z.
• Pin the installed skill to a version, immutable commit, or content digest if the installer supports it.
• Publish expected integrity hashes or signature-verification instructions for release artifacts.
• Document the expected package registry and avoid silently accepting packages from alternate or user-controlled registries.
• Review the pinned CLI and skill release before updating either version.
• Use lockfiles or equivalent dependency-integrity controls where supported.
• Recommend running installation without administrative privileges and in an isolated environment when practical.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README presents the skill as exclusively producing French practice content every time the user invokes it, with no indication that the user can choose another language or opt into the locale constraint. Under the policy rule, forcing a specific language without opt-in is a natural-language locale policy violation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The README instructs users to run npx clawhub@latest install ..., which fetches and executes the latest published package version at install time. This creates a supply-chain risk because a compromised or malicious future release could run arbitrary code on the user's system during installation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill requires English meanings and English translations as part of every session, which imposes a specific output language by default. Under the policy, forcing a language without user opt-in is a natural-language locale/language violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The instructions explicitly require 'Plain English explanation' and describe mistakes made by English speakers, which assumes and enforces English as the instructional language. The file does not offer the user any language preference selection or justify the restriction as region-specific.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest context and README consistently present this as a French-learning skill, covering vocabulary, grammar, reading, and speaking. Line L15 advertises 'Character/script focus — language-specific writing system practice,' which is mismatched because French does not use a distinct character/script system in the way this feature implies.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.