Spanish Daily Drill

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:25 AM UTC
• Version: 1.0.0

Overview

This is a prompt-only Spanish practice skill with no hidden runtime access, though its install command uses a mutable npx latest tag.

This skill appears safe to install as a Spanish-learning prompt. Use normal caution with the documented npx install command because @latest can change over time; avoid running installers with elevated privileges, and only store your Spanish level in memory if you want that preference retained.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:33

Finding

Unpinned Third-Party Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 33–35
Vulnerability Type: Unpinned and mutable third-party installation dependency
Risk Level: Medium

Vulnerable Code

bash

npx clawhub@latest install tetsuakira-vk/spanish-daily-drill

Technical Analysis

The documented installation procedure directs users to execute the mutable latest release of the third-party clawhub npm package through npx. When the package is not already available locally, npx can retrieve and execute it directly from the configured npm registry.

The latest tag is not immutable and may point to different package contents over time. The project does not pin a reviewed version, provide an integrity hash, require package provenance verification, or offer a local validation step before execution. Consequently, the code executed by this command can differ from the code reviewed when the documentation was published.

This does not establish that the current clawhub package is malicious. The vulnerability is the trust placed in a mutable external release and its publisher account. Compromise of the package, registry namespace, maintainer credentials, or release process could turn the documented installation command into a code-execution vector.

Attack Path

1. An attacker compromises the clawhub package publisher account, package namespace, release pipeline, or another trusted distribution component.
2. The attacker publishes a malicious package version and assigns it to the npm latest tag.
3. A user follows the installation instructions and runs:

   bash

   npx clawhub@latest install tetsuakira-vk/spanish-daily-drill
   

4. npx retrieves the attacker-controlled release from the configured package registry.
5. The malicious package code or applicable lifecycle behavior executes with the privileges of the user running the command.
6. The payload can access resources available to that user and may alter the installation process or i ...[truncated 878 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace @latest with a specific, reviewed package version:

   bash

   npx clawhub@<reviewed-version> install tetsuakira-vk/spanish-daily-drill
   

2. Update the pinned version only after reviewing release notes, package provenance, ownership changes, and relevant source differences.
3. Document the expected official registry and package publisher so users can detect namespace or registry substitution.
4. Publish and verify package integrity information or signed provenance where the distribution platform supports it.
5. For controlled deployments, install dependencies through a lockfile-based workflow using reproducible, integrity-checked versions rather than executing a mutable registry tag.
6. Run installation with the least-privileged user necessary and avoid using administrator or root privileges.
7. In CI/CD environments, isolate installation, restrict network and filesystem access, and avoid exposing unrelated credentials during package execution.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence

Finding

The installation command uses npx clawhub@latest, which fetches and executes the latest published package version at install time rather than a pinned, reviewed version. This creates a supply-chain risk: if the package is compromised or a breaking/malicious update is published, users may execute unintended code during installation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The usage section says to invoke the skill with "Use spanish-daily-drill" or "Use spanish-daily-drill at [level]", but it does not define whether these are the only accepted triggers or provide exclusion conditions. Without explicit trigger scope or negative examples, the activation guidance is somewhat ambiguous and could lead to unintended invocation behavior in systems that match loosely on natural language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The instructions require English meanings and English translations as part of every session, which imposes a specific language choice on all users. The file does not offer the user any option to choose another support language or to opt into English-only explanations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill manifest and README describe a Spanish daily drill, but line L15 promises "language-specific writing system practice," which implies support for non-Spanish scripts or character systems. Spanish uses the Latin alphabet, so this documented behavior does not align with the declared Spanish-specific purpose.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.