Viral Thread Writer

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:32 AM UTC
• Version: 1.0.1

Overview

This is a straightforward prompt-only writing skill with a normal installation caution and no hidden code, data access, or persistence.

Review or pin the ClawHub installer version if your environment requires strict supply-chain controls. Expect the skill to use only text you provide in chat; for URLs, it should ask you to paste the content instead of browsing directly.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:47

Finding

Unpinned Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 47–50
Vulnerability Type: Unpinned third-party installer and mutable supply-chain dependency
Risk Level: Medium

Vulnerable Code

bash

npx clawhub install tetsuakira-vk/viral-thread-writer

Technical Analysis

The documented installation command invokes clawhub through npx without specifying a reviewed package version or integrity value. If the package is not already available locally, npx may retrieve its current version from the configured npm registry and execute it immediately.

The requested skill identifier is also not pinned to an immutable version or artifact digest. Consequently, both the installer implementation and installed skill content may differ from the versions assessed during this audit. This creates a supply-chain trust boundary in which remotely mutable third-party content is executed or installed based solely on its package and repository names.

No evidence in the reviewed files demonstrates that the current clawhub package or skill is malicious. The risk arises from the installation process allowing future package compromise, account takeover, registry substitution, or mutable release replacement to affect users after the project has been reviewed.

Attack Path

1. An attacker compromises the npm publication account, registry resolution path, or another distribution channel used for the clawhub package; alternatively, the attacker compromises the mutable skill publication channel.
2. The attacker publishes a modified installer package or skill artifact under the expected identifier.
3. A user follows the README and runs npx clawhub install tetsuakira-vk/viral-thread-writer.
4. npx resolves and executes the remotely supplied installer version, or the installer retrieves the modified skill.
5. Malicious installer code executes with the permissions of the invoking user, or altered skill i ...[truncated 906 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the ClawHub CLI to a specifically reviewed version, for example by documenting an installation command that includes an exact package version rather than resolving the latest release.
2. Pin the skill itself to a specific immutable release, commit hash, or artifact digest if ClawHub supports that capability.
3. Publish the expected package source, registry, version, and integrity hash so users can verify the downloaded artifact before execution.
4. Prefer installing the verified CLI separately and invoking the installed binary, rather than combining remote retrieval and immediate execution through an unpinned npx command.
5. Use a lockfile and npm integrity metadata where the installation workflow supports them.
6. Add release-signature or checksum verification for both the installer and skill artifact.
7. Run the installer under a least-privileged account or isolated environment, and review installer lifecycle scripts before execution.
8. Update the README whenever the audited installer or skill version changes, ensuring each documented version undergoes a new security review.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The README instructs users to run npx clawhub install ... without pinning a specific package version. This can cause users to fetch and execute whatever version is current at install time, creating a supply-chain risk if a malicious or compromised release is published later. In this context, the command is an installation step, so the risk is real because users may copy-paste it directly from the documentation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The requirements section again references npx clawhub without a pinned version, reinforcing a pattern of unversioned remote execution. Even in documentation, this is dangerous because it normalizes running a mutable package version that could later be replaced or compromised, leading to arbitrary code execution on the user's machine.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The instructions prescribe 'plain English' for the Casual/Conversational tone, which imposes a language choice without offering the user a language or locale option. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.