Japanese Daily Drill

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:24 AM UTC
• Version: 1.0.0

Overview

This is a coherent Japanese study prompt skill with no hidden runtime access, though its README uses an unpinned npx installer command.

Install only if you want Japanese JLPT-style practice. Prefer using a pinned, trusted ClawHub installer version rather than `clawhub@latest`, and avoid running install commands with elevated privileges. The skill itself does not appear to access files, credentials, services, or persistent system features.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:31

Finding

Unpinned npm Package Execution in Installation Instructions

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 31–35
Vulnerability Type: Supply-chain risk from mutable third-party package execution
Risk Level: Medium

markdown

## Installation

```bash
npx clawhub@latest install tetsuakira-vk/japanese-daily-drill

text

### Technical Analysis

The installation instructions invoke `npx` with the mutable `clawhub@latest` version selector. When a user runs this command, `npx` may download and execute package code from the configured npm registry without an exact version pin, integrity constraint, or documented provenance-verification step.

The behavior being executed can therefore change after this project has been reviewed. A compromised maintainer account, malicious package release, or registry-level supply-chain incident could cause a future `latest` version to execute unintended code. The audited project does not itself contain malicious executable code; the risk arises from instructing users to execute an unpinned external dependency.

### Attack Path

1. An attacker compromises the npm package, its publisher account, or its release pipeline.
2. The attacker publishes a malicious version that becomes the package's `latest` release.
3. A user follows the documented installation command.
4. `npx` retrieves the mutable malicious release from the configured registry.
5. Package lifecycle code or CLI entry-point code executes under the installing user's account.
6. The payload can access resources available to that user and perform arbitrary actions within those privileges.

### Impact Assessment

Successful exploitation could permit arbitrary code execution with the privileges of the user running the installation command. Depending on that user's environment, the malicious package could read or modify user-accessible files, steal environment variables or development credentials, alter local configuration, or install additional software.

The scope is limi
...[truncated 226 chars]

Remediation

View remediation

Remediation Suggestions

• Replace @latest with an exact, reviewed package version, for example clawhub@X.Y.Z.
• Document the expected npm registry and package publisher so users can verify provenance.
• Publish and verify the package integrity digest where the installation workflow supports it.
• Review release artifacts before updating the documented version.
• Use a lockfile or equivalent immutable dependency record in automated installation workflows.
• Advise users not to execute the command with administrative privileges.
• Consider separating package download from execution so users can inspect the resolved package and version before running it.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The skill is framed as a Japanese-only practice workflow and assumes the user wants Japanese content, levels, and JLPT alignment, without explicitly offering a language choice or opt-in. This can be interpreted as a locale/language constraint in the natural-language description.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README defines invocation as "Use japanese-daily-drill" and "Use japanese-daily-drill at [level]" but does not clarify whether these are the only supported trigger phrases, where they must be entered, or any negative examples. For a markdown skill description, this leaves activation scope somewhat ambiguous and could lead to unintended invocation attempts.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.