Draft Agent Loop

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:19 AM UTC
• Version: 1.6.0

Overview

This skill is a disclosed Draft-based approval workflow, but users should understand it depends on an unpinned external CLI and stores task journals in Draft pages.

Install this only if you want Draft pages used as the durable task journal for agent oversight. Avoid putting secrets or sensitive personal data in the task context, and prefer a pinned or otherwise verified draft-cli dependency in higher-risk environments.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13

Finding

Unpinned Third-Party npm CLI Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13-25
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

yaml

dependencies:
  - name: "toliuweijing/draft-cli"
    type: "other"
    url: "https://clawhub.ai/toliuweijing/draft-cli"
requires:
  bins:
    - "draft"
install:
  - id: "npm"
    kind: "node"
    package: "@innosage/draft-cli"
    bins:
      - "draft"
    label: "Install draft-cli (npm)"

Technical Analysis

The skill directs the environment to install and execute the external npm package @innosage/draft-cli, but it does not pin the package to an exact audited version or specify an integrity hash. Consequently, a later installation may resolve to package content that differs from the version reviewed when this skill was published.

This creates a supply-chain trust boundary: the effective executable behavior is controlled partly by the npm package publisher and package-distribution infrastructure rather than solely by the audited project. The separate dependency reference to toliuweijing/draft-cli also provides no immutable revision or content digest.

This finding does not establish that the current dependency is malicious. The vulnerability is the absence of controls ensuring that the installed dependency remains the exact artifact that was reviewed.

Attack Path

1. An attacker compromises the npm publisher account, package repository, or another relevant package-distribution component.
2. The attacker publishes a malicious release under the trusted @innosage/draft-cli package name.
3. A user installs the dependency according to the skill metadata, with no exact version or integrity constraint.
4. Package resolution retrieves the attacker-controlled release.
5. The malicious package may execute through installation lifecycle scripts or when the documented draft commands are invoked.
6. The payload runs with the permissions of ...[truncated 657 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin @innosage/draft-cli to an exact, reviewed version rather than relying on unconstrained package resolution.
2. Enforce a lockfile and verified npm integrity digest for the selected package artifact.
3. Pin the ClawHub dependency to an immutable release or commit and verify its content hash.
4. Disable npm lifecycle scripts during installation when they are unnecessary, or explicitly audit every required lifecycle script.
5. Verify publisher provenance and package signatures where supported.
6. Run the CLI in a least-privileged isolated environment with access limited to the data and network destinations required for Draft operations.
7. Establish an update process that re-audits dependency changes before advancing the pinned version.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger condition "high-stakes or complex enough to warrant human gates" is subjective and overly broad, allowing the skill to activate without an explicit user request for this workflow. In a remote-agent orchestration context, that can cause the agent to publish task details externally or reshape the interaction model based on its own judgment rather than clear user consent.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

md

Do NOT trigger this skill when:

- The user asks to do a task directly with no mention of approval or review gates.
- The user only asks about raw Draft commands or page automation without approval gates (use `draft-cli`).
- The user wants a local-file authoring workflow (authorship in local markdown).

## Core Rules

Static analysis

No suspicious patterns detected.