Security audit

Clawhub Oneshot

Security checks for vulnerabilities and agentic risk

Overview

This skill is for real-world paid agent actions and is mostly purpose-aligned, but it exposes wallet credentials to unpinned packages and normalizes purchases and outreach without strong approval guidance.

Review carefully before installing. Use exact pinned versions, avoid `npx -y` with wallet secrets, prefer narrowly scoped CDP credentials over raw private keys, use low-balance wallets and test mode first, and require explicit human approval before purchases, paid research, emails, SMS, calls, website builds, or data enrichment involving personal information.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Error

Location: SKILL.md:19
Finding: Unpinned SDK Dependency Is Entrusted with Wallet Credentials
Content: View full analysis
Remediation: View remediation
``` 2. Commit and enforce a lockfile, and use `npm ci` in controlled deployments. 3. Verify registry provenance, package signatures where supported, and package integrity hashes. 4. Audit the SDK source, release artifacts, lifecycle scripts, and transitive dependencies before granting access to production credentials. 5. Prefer isolated CDP credentials with only the minimum required permissions over raw private keys. 6. Use a dedicated low-balance wallet with spending, destination, rate, and transaction-value limits. 7. Keep production credentials outside general-purpose process environments where possible; use a managed secret store and short-lived credentials. 8. Require explicit human approval for high-value purchases, arbitrary destinations, or production-mode transactions. 9. Monitor wallet activity and rotate or revoke credentials immediately if package compromise is suspected. ]]>

T08 · Insecure Dependencies

Error

Location: SKILL.md:252
Finding: Automatic Execution of Unpinned MCP Package with Wallet Secrets
Content: View full analysis
Remediation: View remediation
``` 3. Configure the MCP client to invoke the fixed local executable directly, such as: ```json { "command": "./node_modules/.bin/oneshot-mcp-server", "args": [] } ``` 4. Verify package integrity, provenance, lifecycle scripts, and transitive dependencies before deployment. 5. Run the MCP server in a restricted container or sandbox with minimal filesystem, network, and operating-system permissions. 6. Supply narrowly scoped, revocable CDP credentials instead of raw private keys whenever possible. 7. Use a dedicated wallet with low balances, transaction limits, destination allowlists, and monitoring. 8. Avoid exposing unrelated environment variables to the MCP process. Retrieve secrets through a controlled secret broker where feasible. 9. Require manual approval for production transactions and rotate all wallet credentials after any suspected dependency compromise. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly enables autonomous external actions including email, calls, research, purchases, and data enrichment, but it does not prominently warn that these operations may contact third parties, process personal data, or spend funds. In an agent setting, missing consent and impact warnings can cause unauthorized transactions, privacy violations, and unintended real-world effects.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The commerce example demonstrates placing a real purchase with shipping details and a spending cap but does not clearly warn that it can create actual orders using available funds. In the context of an autonomous agent commerce SDK, this omission is especially dangerous because it can lead to unauthorized purchases, misuse of personal data, and financial loss.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The activation guidance is broad enough to match many generic agent tasks, which increases the chance this skill is invoked in contexts where external actions, payments, or outreach were not the user's clear intent. Because this skill can trigger real-world communications and commerce, over-broad routing meaningfully raises the risk of unintended spending, outreach, or data disclosure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The examples show direct email, SMS, and voice actions as routine SDK calls without emphasizing that they will contact real recipients outside the system. This normalizes immediate execution and increases the chance an integrating agent will send messages or place calls without clear user authorization or recipient verification.
Content: No source excerpt is available for this finding.