Podcast Producer

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:24 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward podcast transcript helper with a documented installer caution but no hidden execution, persistence, or unrelated data access.

Before installing, prefer a trusted or pinned ClawHub installer command if your environment supports it, and only provide transcript files you intend the agent to read. The skill itself is content-generation oriented and does not request credentials or external services.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:31

Finding

Unpinned npm CLI Execution Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 31–35
Vulnerability Type: Unpinned third-party executable dependency
Risk Level: Medium

Vulnerable Code

markdown

## Installation

```bash
npx clawhub install tetsuakira-vk/podcast-producer

text

### Technical Analysis

The documented installation procedure invokes `clawhub` through `npx` without specifying an exact package version or integrity digest. If the package is not already available locally, `npx` can retrieve the currently resolved version from the configured npm registry and execute its CLI code with the invoking user's permissions.

Because the command resolves mutable third-party content at execution time, the code ultimately executed may differ from the code reviewed when this Skill was audited. The project contains no lockfile, vendored installer, integrity metadata, or other mechanism that constrains the installer to a known audited artifact.

This is a supply-chain weakness rather than evidence that the current `clawhub` package is malicious. Exploitation depends on compromise or malicious replacement of the package, its maintainer account, the package registry, or the user's registry configuration.

### Attack Path

1. An attacker compromises the npm package, a publisher account, the configured package registry, or another component controlling resolution of the unversioned `clawhub` package.
2. The attacker publishes or serves a modified package version containing malicious CLI or lifecycle code.
3. A user follows the README and runs:
   ```bash
   npx clawhub install tetsuakira-vk/podcast-producer
   ```
4. `npx` resolves and downloads the attacker-controlled package version because the command does not pin a reviewed version or verify an integrity digest.
5. The downloaded package executes under the user's account and can perform any operation available to that account.

### Impact Assessment

Successful exploit
...[truncated 716 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin clawhub to an exact, reviewed version rather than resolving the latest available release:

   bash

   npx clawhub@<reviewed-exact-version> install tetsuakira-vk/podcast-producer
   

2. Document the expected npm registry and verify the package provenance before installation.
3. Provide a published integrity digest or signed release verification procedure for the exact installer artifact.
4. Prefer invoking a separately installed and administratively approved clawhub binary where managed environments support that workflow.
5. Avoid running the installation command with administrator or root privileges.
6. Review package lifecycle scripts and disable them where operationally possible.
7. Update the pinned version only after reviewing and testing the new release, rather than automatically tracking mutable latest versions.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The README instructs users to run npx clawhub install ... without pinning a specific clawhub version. Because npx resolves and executes the latest available package by default, a compromised, maliciously updated, or typosquatted package release could cause arbitrary code execution on the user's machine during installation. In this context, the risk is real because the README is explicitly providing an installation command that users are likely to copy and run verbatim.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

md

## Output format

Always produce all five outputs in a single response, clearly separated with headers. Do not ask the user which ones they want — deliver the full package every time.

---