ClawHub
Back to skill

Security audit

Marketing Mode

Security checks for vulnerabilities and agentic risk

Overview

The marketing guidance itself is ordinary, but the install metadata asks for an unpinned global npm install that can run unreviewed package code during installation.

Review the npm package and prefer a pinned, integrity-checked, non-global install before using this skill. The marketing prompt content appears ordinary, but the install metadata gives the package manager more authority than the visible skill content needs.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
skill.json:24
Finding

Unpinned External npm Package Installed Globally

Content
View full analysis

Vulnerability Details

File Location: skill.json:24-26 and skill.json:42-49
Vulnerability Type: Unpinned third-party dependency and unsafe global installation
Risk Level: Medium

Vulnerable Code

json
"install": {
  "npm": "npm install -g @thesethrose/marketing-mode"
},
json
"install": [
  {
    "id": "npm-pkg",
    "kind": "npm",
    "package": "@thesethrose/marketing-mode",
    "label": "Install Marketing Mode (npm)"
  }
]

Technical Analysis

The configuration directs users or the skill manager to install @thesethrose/marketing-mode without an exact version or integrity constraint. npm therefore resolves a mutable package release, normally the package's current distribution tag. The implementation of that external package is not included in the audited project and could not be inspected.

npm packages can define lifecycle scripts that execute during installation. If the package publisher account, registry entry, or release pipeline is compromised, a malicious future version could run code with the permissions of the user performing the installation. The -g option expands the installation's scope to the user's global npm environment.

This is a supply-chain exposure rather than evidence that the current external package is malicious. The project also documents clawdhub install marketing-mode in README.md:8, resulting in inconsistent installation mechanisms and trust boundaries.

Attack Path

  1. An attacker compromises the npm publisher account, package release process, or another component controlling @thesethrose/marketing-mode.
  2. The attacker publishes a malicious version and makes it the version resolved by the package's default distribution tag.
  3. A user or automated skill installer processes skill.json and executes npm install -g @thesethrose/marketing-mode.
  4. npm retrieves the unreviewed release and may execute its installation lifecycle ...[truncated 839 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the dependency to an exact reviewed version, for example @thesethrose/marketing-mode@1.0.0, rather than resolving a mutable distribution tag.
  2. Verify the package using a trusted lockfile and registry-provided integrity hash.
  3. Avoid global installation where possible. Install into an isolated, least-privileged project directory or sandbox.
  4. Disable npm lifecycle scripts during installation with --ignore-scripts unless they are explicitly required and have been reviewed.
  5. Include the package source in the repository or reference an immutable source revision so the installed implementation can be audited alongside the skill.
  6. Use one consistent, documented installation mechanism and clearly define its source and trust boundary.
  7. Add automated dependency provenance, signature, vulnerability, and publisher-change checks before releases are accepted.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README says, "Then tell Clawdbot to switch modes," but does not specify the exact trigger phrase, scope, or exclusion conditions for activation. This is broad enough to leave users unsure when the skill should activate and increases the chance of unintended or inconsistent invocation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The activation rule is broad enough that the mode may engage on vague requests for 'marketing help' without sufficiently confirming user intent or scope. In an agent system, over-broad activation can cause inappropriate context switching, unsolicited persuasive guidance, or application of marketing tactics in situations where the user did not explicitly request this specialized behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The activation rule 'When users want marketing help, switch to this mode' is broad and underspecified, so the agent may enter this mode for loosely related requests and apply a marketing persona where it is not appropriate. That can cause scope confusion, reduce reliability of routing, and potentially override safer or more specialized behaviors in mixed-context conversations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.