Placeholder Skill

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:36 AM UTC
• Version: 0.0.1

Overview

This package is a placeholder that does not run code itself, but it points users to an unpinned main skill with public-posting and third-party-service capabilities that were not included for review.

Treat this as a pointer, not the full reviewed skill. Before installing `contentclaw`, verify the exact package publisher and version, review its implementation and permissions, and avoid granting Reddit, X, search, image-generation, or tracking credentials unless publishing requires explicit confirmation and the scope is clear.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12
• Finding: Unpinned External Skill Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 12-16 **Vulnerability Type**: Unpinned external dependency installation **Risk Level**: Medium **Complete Code Snippet**: ```markdown This is a reserved name. Install the main skill instead: ``` clawhub install contentclaw ``` ``` ### Technical Analysis The skill instructs the user to install a separate package identified only by the mutable name `contentclaw`. The command does not specify an immutable version, cryptographic digest, trusted publisher identity, or integrity-verification procedure. The external package is not included in the audited project, so its implementation and effective behavior cannot be verified from this artifact. Registry resolution may return content that was published or modified after this placeholder was reviewed. This creates a supply-chain trust boundary in which the package ultimately executed by the user can differ from the reviewed content. No evidence establishes that the referenced package is currently malicious. The vulnerability is the unsafe, unpinned installation mechanism and the inability to verify the external package from the supplied project. ### Attack Path 1. A user loads or reviews this placeholder skill. 2. The user follows its recommendation and runs `clawhub install contentclaw`. 3. The registry resolves the mutable `contentclaw` package name at installation time. 4. An attacker who has compromised the package, publisher account, registry, or name-resolution process supplies modified content. 5. The unaudited external skill is installed and may execute with the tools, credentials, data, and permissions made available to the Agent. ### Impact Assessment The direct artifact contains no executable implementation and does not itself demonstrate code execution, credential theft, persistence, or privilege escalation. However, successful supply-chain compromise of the referenced package could expose all ...[truncated 489 chars]
• Remediation: ## Remediation Suggestions 1. Pin the external skill to an immutable, reviewed version rather than resolving only the mutable package name. 2. Verify the package using a cryptographic digest or signed provenance metadata before installation. 3. Document the expected registry, publisher identity, package version, and integrity value. 4. Require explicit user approval after displaying the exact package version and publisher that will be installed. 5. Audit the resolved `contentclaw` implementation before granting it access to credentials, publishing accounts, local files, or network tools. 6. Apply least privilege by granting only the capabilities necessary for the requested operation. 7. Prefer including the complete reviewed implementation in the audited artifact so its behavior does not change independently after review.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The skill metadata describes very broad autonomous capabilities without defining clear trigger conditions, user-consent boundaries, or operational limits. In an agent ecosystem, vague scope increases the chance of overbroad invocation and unintended use of external services or publishing workflows beyond what a user expected.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The feature list references autonomous topic discovery, image generation via third parties, and publishing to Reddit and X, but provides no warning about data transfer, credential use, or the risks of automated posting. This omission can mislead users into invoking a skill that may send content to external services or publish publicly without informed consent, creating privacy, reputational, and compliance risk.

Static analysis

No suspicious patterns detected.