ClawHub
Back to skill

Security audit

Music Discovery Guide

Security checks for vulnerabilities and agentic risk

Overview

This is a simple music-recommendation skill with no bundled code, credential use, persistence, or hidden behavior found.

Before installing, consider using a pinned and trusted ClawHub installer version instead of `@latest` if the platform supports it. The skill itself is low risk: it only guides an agent to provide music recommendations and does not ask for accounts, files, secrets, or system access.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:36
Finding

Unpinned Package Execution Through a Mutable Release Tag

Content
View full analysis

Vulnerability Details

File Location: README.md:36-40
Vulnerability Type: Supply-chain risk caused by executing an unpinned third-party package
Risk Level: Medium

Vulnerable Code:

bash
npx clawhub@latest install tetsuakira-vk/music-discovery

Technical Analysis

The documented installation command invokes npx with the mutable clawhub@latest package reference. Depending on the local npm configuration and cache, npx may download and execute the package from the npm registry. The latest tag can be reassigned to a different release after this project has been reviewed.

The repository does not provide an exact dependency version, integrity hash, lockfile, or vendored installer implementation for this command. Consequently, the code ultimately executed by users cannot be verified solely from the audited project. This creates a supply-chain exposure if the upstream package, maintainer account, publication process, or mutable release tag is compromised.

Attack Path

  1. An attacker compromises the upstream clawhub package, its maintainer account, or its publication pipeline.
  2. The attacker publishes a malicious version and assigns the npm latest tag to it.
  3. A user follows the installation instructions and runs:
    bash
    npx clawhub@latest install tetsuakira-vk/music-discovery
  4. npx retrieves the attacker-controlled release from the package registry.
  5. The package's CLI code or applicable lifecycle behavior executes with the permissions of the invoking user.

This exploitation path depends on compromise or malicious modification of the external package; no malicious payload is present in the audited repository itself.

Impact Assessment

A malicious upstream release could execute arbitrary code under the invoking user's account. Depending on that account's privileges and environment, potential effects could include reading or modifying user-accessible fil ...[truncated 482 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace the mutable @latest reference with an exact, reviewed version:
    bash
    npx clawhub@<exact-version> install tetsuakira-vk/music-discovery
  2. Document the expected official package publisher and registry so users can verify the source before execution.
  3. Where supported, provide the expected package integrity digest and instructions for validating it.
  4. Use a lockfile or another reproducible installation mechanism when integrating the package into a larger project.
  5. Review and test each new clawhub release before updating the documented version.
  6. Advise users not to run the installation command with administrative or root privileges.
  7. Consider providing a non-executing download-and-verification workflow so users can inspect the installer before running it.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The installation command uses npx clawhub@latest, which fetches and executes the latest published package version at install time rather than a pinned, reviewed version. If the upstream package is compromised, typosquatted, or a malicious update is released, users could execute attacker-controlled code during installation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The README instructs users to invoke the skill with the pattern "Use music-discovery for: [mood / artist / genre / activity]", which accepts very broad everyday inputs such as moods or activities without defining when the skill should or should not be selected. Although the skill name is specific, the trigger guidance does not provide exclusion conditions or boundaries, increasing the chance of unintended invocation for general music-related requests.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown file defines detection criteria using very broad natural-language categories such as any mood, activity, or specific request. Without exclusions, negative examples, or a narrower invocation boundary, the skill could match a wide range of ordinary conversation about music.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.