ClawHub
Back to skill

Security audit

AI Agent 技能包变现路径顾问

Security checks for vulnerabilities and agentic risk

Overview

This skill provides marketplace planning guidance without requesting sensitive access or performing account actions.

Use this as a planning aid and verify marketplace terms independently; its supporting checklist is unfinished. Directly loading the reviewed local files avoids the optional external installer. If using that installer, review and pin its package and repository versions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

MCP server referenced without pinned version: 'npx skills'.

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The documented installation command uses npx skills without a version pin, allowing npm to resolve and execute a changing package version with the user's privileges. If that package or its publishing account is compromised, installation could execute malicious code; this is a supply-chain risk rather than evidence of malicious intent. The MCP-server label is inaccurate because this is a CLI installation command, and its placement in documentation makes exploitation dependent on someone running it.

Content

No source excerpt is available for this finding.