ClawHub
Back to skill

Security audit

interview-pro

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward interview-preparation skill, with optional install examples that users should verify before running.

Install is reasonable for interview preparation use. Before copying the optional integration commands, check that the referenced skills and `clawhub` package are from the expected publisher, and prefer pinned versions instead of `@latest`.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:199
Finding

Unpinned Third-Party Skill Installation Commands

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 199–203
Vulnerability Type: Supply-chain risk from mutable, unverified dependencies
Risk Level: Medium

Vulnerable Code

markdown
| resume-studio | Word/PDF resume | `npx clawhub@latest install resume-studio` |
| resume-html | HTML resume | `npx clawhub@latest install resume-html` |
| research-orchestrator | Industry research | `npx clawhub@latest install research-orchestrator` |
| word-studio | Word report | `npx clawhub@latest install word-studio` |
| pdf-studio | PDF report | `npx clawhub@latest install pdf-studio` |

Technical Analysis

The documented integration commands invoke npx with the mutable clawhub@latest package reference and install five third-party Skills without fixed versions, integrity hashes, lockfiles, or publisher verification.

Because latest can resolve to a different package release over time, the effective installation behavior may change after this Skill has been audited. The referenced Skills are also identified only by mutable names. If the npm package, distribution account, registry resolution, or any referenced Skill is compromised, users following these commands could retrieve and execute content that was not included in this audit.

This is an insecure dependency and supply-chain pattern. The reviewed file does not prove that any current upstream package is malicious, but its installation guidance lacks controls that would make dependency retrieval reproducible and verifiable.

Attack Path

  1. An attacker compromises the publisher account, release process, or another distribution component for clawhub, or gains control of a referenced Skill.
  2. The attacker publishes a modified release selected by the mutable latest tag or replaces the content associated with one of the referenced Skill names.
  3. A user follows an installation command from SKILL.md.
  4. npx retrieves and runs the package currently resolved as clawhub@latest. 5 ...[truncated 758 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace clawhub@latest with an exact, reviewed version, for example clawhub@X.Y.Z.
  2. Pin exact versions or immutable identifiers for every referenced Skill.
  3. Verify downloaded artifacts using cryptographic integrity hashes or signed provenance metadata.
  4. Use lockfiles or an equivalent reproducible dependency manifest where supported.
  5. Document the expected publisher, package source, version, and checksum for each integration.
  6. Review each referenced Skill and its transitive dependencies before recommending installation.
  7. Configure installation tooling to reject unexpected registries, unsigned artifacts, and version drift.
  8. Update pinned versions only through a controlled review and security-testing process.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The trigger list includes generic phrases such as "优化简历 / Optimize my resume" and "模拟面试 / Mock interview," which are common everyday requests and could match many general-assistant conversations. The file does not provide constraints, negative examples, or activation boundaries to distinguish when this specific skill should be invoked versus normal chat assistance.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The skill instructs users to run npx clawhub@latest install ..., which pulls and executes the latest package version at install time rather than a fixed, audited version. If the upstream package is compromised or a malicious release is published, users could execute attacker-controlled code simply by following the documented integration steps.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

This integration command uses npx with clawhub@latest, creating a supply-chain risk because the exact code executed is not fixed. In a skill file, such instructions are especially risky because they normalize copy-paste execution of remote package code by end users.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

Referencing npx clawhub@latest for installation means the executed package can change over time without review, exposing users to dependency hijacking or malicious upstream updates. Because this appears in an integrations section, it could directly influence user behavior and lead to code execution on their systems.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The command at this line relies on a floating latest tag, which is unsafe for executable package installation because it defeats reproducibility and trust review. An attacker who compromises the package publisher or distribution path could turn this documentation into an infection path.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

Using npx with an unpinned package version exposes users to remote code execution risk through the software supply chain. Even though the skill itself is not executing code, it instructs users to do so, which materially increases the danger of a compromised package release.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The description is partially written in Chinese and partially in English, but it does not explicitly state that responses should follow the user's preferred language or allow opt-in selection. For a general-purpose interview assistant with full industry coverage, this can implicitly bias interaction toward specific languages without documented user choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.