ClawHub
Back to skill

Security audit

DropClaw Store

Security checks for vulnerabilities and agentic risk

Overview

The skill clearly describes a user-directed encrypted permanent file storage workflow with disclosed network, payment, and key-management requirements.

Before installing or using this skill, verify the DropClaw SDK/package identity, consider pinning exact package versions, review payment details before authorizing any MON, SOL, or USDC transaction, and keep encryption keys backed up because the service says retrieval cannot decrypt data without them.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:60
Finding

Unpinned Third-Party SDK Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 60
Vulnerability Type: Unpinned dependencies from public package registries
Risk Level: Medium

text
Install SDK: `npm i dropclaw` or `pip install dropclaw`

Technical Analysis

The documentation instructs users to install the latest available dropclaw package from either npm or PyPI without specifying an exact version, lockfile, package hash, verified source repository, or other integrity constraint. The package implementation is not included in the audited project, so its behavior cannot be verified from the supplied files.

Because public registry releases are mutable from the consumer's perspective, a future compromised or malicious release could be installed under these instructions. Depending on package-manager behavior, package installation may execute lifecycle hooks; the installed SDK will also execute when subsequently imported or invoked.

Attack Path

  1. An attacker compromises the publisher account, release process, or a transitive dependency associated with one of the referenced registry packages.
  2. The attacker publishes a malicious release under the expected package name.
  3. A user follows the documented unversioned npm i dropclaw or pip install dropclaw instruction.
  4. The package manager resolves and downloads the attacker-controlled release.
  5. Malicious code executes through installation hooks or when the SDK is imported or invoked.
  6. The code may access data and credentials available to the installing user or manipulate the Skill's encryption, upload, and payment workflow.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the privileges of the user installing or running the SDK. The accessible scope may include local files, environment variables, wallet or payment data available to the process, plaintext selected for storage, and locally generated encryption keys. A compromis ...[truncated 199 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin each SDK to a reviewed, exact version rather than installing the latest release.
  2. Provide and enforce lockfiles for all package ecosystems used by the project.
  3. Verify package integrity with registry checksums, hashes, signatures, or provenance attestations.
  4. Link to the verified source repository and document the expected publisher identity.
  5. Audit the pinned SDK and its transitive dependency tree before recommending installation.
  6. Disable package installation scripts where feasible, such as with npm's --ignore-scripts, unless reviewed functionality requires them.
  7. Use reproducible builds and automated dependency monitoring to detect publisher, checksum, or dependency-tree changes.
  8. Run installation and SDK operations with least privilege and isolate access to wallets, secrets, plaintext files, and encryption keys.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep