ClawHub
Back to skill

Security audit

🧠 Thinking Frameworks

Security checks for vulnerabilities and agentic risk

Overview

This is a Markdown-only thinking-framework skill with no hidden runtime authority; the main caveat is unpinned install guidance using npx @latest.

Before installing, verify that you trust the ClawHub CLI source and consider using a pinned CLI version instead of @latest, especially on sensitive machines. Expect this skill to add persistent reasoning templates that may activate on broad analysis requests, but I found no hidden code execution, credential access, data exfiltration, or destructive behavior in the artifact.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 Β· Insecure Dependencies

Warning
Location
README.md:12
Finding

Unpinned npm CLI Execution in Installation Instructions

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (11)

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
85% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt Β· references/lateral-thinking.md (reported line 41)May include surrounding context.

md
- **Wishful thinking**: "Wouldn't it be nice if..." β€” state something seemingly impossible, then find a stepping stone to reality.
- **Random entry**: Pick a random concrete noun (object, animal, place). Force a connection between it and the problem. What new ideas emerge?

For each provocation, don't judge β€” follow the idea for at least 3 steps to see where it leads.

## Step 4: Analogies from Distant Domains

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
80% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt Β· references/six-thinking-hats.md (reported line 32)May include surrounding context.

md
- What **facts and data** do we currently have about this topic?
- What are the **key numbers, statistics, and measurements**?
- What information is **missing** that we need?
- What information is **disputed or uncertain**? (State both sides without judging.)
- What is the **source and reliability** of our data?
- Distinguish clearly between: **verified facts** / **believed but unverified** / **gaps in knowledge**

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The promotion text instructs users to run npx clawhub@latest install thinking-frameworks, which fetches and executes the latest package version at runtime rather than a pinned, reviewed version. If the upstream package is compromised or a breaking/malicious release is published, users following the documentation could execute attacker-controlled code on their systems.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

This line again promotes npx clawhub@latest install thinking-frameworks, causing users to execute the newest remote package without version pinning. That creates a supply-chain risk: a compromised dependency, account takeover, or malicious update could turn the install command into arbitrary code execution.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The installation command uses @latest, which implicitly trusts future unpublished changes and executes them via npx. In a promotional document aimed at broad sharing, this increases exposure because many users may copy-paste the command without reviewing what code will run.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

This occurrence repeats the same unpinned npx execution pattern in the English promotion copy. Because promotional text is designed to maximize reuse, an unsafe install command can propagate quickly and amplify supply-chain compromise impact across many downstream users.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

Referencing npx clawhub@latest in launch materials encourages execution of mutable remote code at the moment of use. That is dangerous because the content of latest can change after the document is published, invalidating any prior review and opening a path for supply-chain abuse.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The README instructs users to execute npx clawhub@latest install thinking-frameworks, which fetches and runs the latest published package version at install time. Because the version is not pinned, a compromised upstream package, malicious new release, or supply-chain hijack could cause users to execute unreviewed code on their system during installation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger section allows activation from broad natural-language cues such as requests for 'deep analysis' or generic command variants, which can cause the skill to invoke when the user did not clearly intend this specific framework pack. In an agent system, ambiguous invocation can override expected behavior, introduce prompt-routing confusion, and increase the chance of unintended use of powerful modes like red-team analysis.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Many listed trigger keywords are ordinary phrases such as 'critical', 'systems', 'probability', 'what if', and 'trade-off', which are likely to appear in normal conversation unrelated to skill activation. This creates invocation collisions that can cause the wrong skill to load, potentially exposing internal routing behavior or steering the agent into unintended reasoning modes without clear user consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

This markdown file includes fixed Chinese and English promotional templates and a bilingual launch plan, but it does not indicate that language selection should be based on user preference or explicit opt-in. Under the policy rule for language or locale constraints, hard-coded language assumptions can be a concern when no choice is offered.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.