Research Brief Generator

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:26 AM UTC
• Version: 1.0.0

Overview

This is a plain Markdown research-brief skill with broad but disclosed topic coverage and no hidden code, credential use, persistence, or data access behavior.

Install only if you are comfortable with the documented ClawHub npx installer flow; for stricter supply-chain control, use a pinned and trusted installer version. Expect the skill to activate for intentionally requested research briefs on many kinds of topics, including sensitive subjects where it may produce content warnings.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:37

Finding

Unpinned Executable npm Dependency in Installation Command

Content

View full analysis

Vulnerability Details

File Location: README.md, line 37
Vulnerability Type: Supply-chain risk from a mutable executable dependency
Risk Level: Medium

Vulnerable Code

bash

npx clawhub@latest install tetsuakira-vk/research-brief

Technical Analysis

The documented installation command uses npx to download and execute the mutable latest release of the clawhub npm package. No exact package version, package integrity hash, lockfile, or other verification mechanism is specified.

Because the latest distribution tag can be reassigned after this project has been reviewed, the code ultimately executed by users may differ from the version that was available during the audit. If the upstream package, maintainer account, publishing credentials, or package registry is compromised, a malicious release could be served through this command.

This is classified as an insecure dependency rather than a confirmed malicious payload: the reviewed project contains no malicious script, and exploitation depends on a future or existing compromise of the external dependency or its distribution channel.

Attack Path

1. An attacker compromises the clawhub npm package, its maintainer account, publishing credentials, or the relevant registry distribution channel.
2. The attacker publishes a malicious package version and assigns it to the latest distribution tag.
3. A user follows the installation instructions and runs the documented npx clawhub@latest ... command.
4. npx retrieves and executes the attacker-controlled package code.
5. The malicious package operates with the privileges and environment access of the user who launched the command.

Impact Assessment

Successful exploitation could permit arbitrary code execution under the installing user's account. Depending on that user's privileges and environment, the payload could access user-readable files, environment variables, tokens, development credentials, source repositories ...[truncated 338 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace @latest with an exact, reviewed version:

   bash

   npx clawhub@X.Y.Z install tetsuakira-vk/research-brief
   

2. Avoid semver ranges and mutable distribution tags in security-sensitive installation instructions.
3. Verify the selected package version and provenance before documenting it.
4. Where supported, validate the package against an expected registry integrity hash or trusted signature.
5. Use a lockfile or an equivalent dependency manifest when installation is performed through a managed project.
6. Document the expected npm registry and trusted package owner to reduce dependency-confusion and registry-substitution risks.
7. Establish an update process in which new installer versions are reviewed before the pinned version is changed.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The installation command uses npx clawhub@latest, which pulls and executes the latest published package version at install time rather than a pinned, reviewed release. That creates a supply-chain risk: if the upstream package is compromised or a breaking/malicious version is published, users may execute untrusted code simply by following the README.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The trigger phrase Use research-brief on: [topic, case, person, or event] is broad and resembles ordinary natural-language conversation, making accidental or unintended invocation more likely. In an agent environment, loose activation can cause the skill to run when a user is merely discussing a topic, which may override expected behavior, consume resources, or cause the agent to produce research output in contexts where it was not explicitly requested.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Line L017 says to 'Accept any topic' and then lists very broad categories, while the front-matter description also frames the skill as usable for 'any topic, person, case, or event.' For a markdown skill file, this is an ambiguous trigger scope with little constraint or exclusion guidance, increasing the chance of unintended invocation for general requests.

Content

No source excerpt is available for this finding.