ClawHub
Back to skill

Security audit

Auto Context

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent context-loading helper, but its install directions rely on mutable unpinned remote commands and it automatically reads local project context files.

Review the install path carefully. Prefer a pinned, reviewed ClawHub version or a specific commit instead of npx add or @latest. After installation, expect the skill to read project context files such as TODO.md, roadmap.md, task_plan.md, handoffs, and some session summaries, so avoid storing secrets or unrelated private notes in those files.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:16
Finding

Unpinned ClawHub Package Execution via npx

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:16-18 and README.md:31-33
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code

SKILL.md:16-18:

bash
npx clawhub@latest install auto-context

The same command is documented in README.md:31-33:

bash
npx clawhub@latest install auto-context

Technical Analysis

The installation instructions direct users to execute clawhub@latest through npx. The latest tag is mutable and does not identify an immutable, previously reviewed package version. When the command is run, npx may download and immediately execute whichever package release the registry resolves under that tag at that time.

Consequently, the effective executable can change after this skill has been audited. Security depends on the continued integrity of the npm account, registry metadata, package publication process, transitive dependencies, and every future release selected by latest.

This is a supply-chain weakness rather than evidence that the current ClawHub package is malicious.

Attack Path

  1. An attacker compromises the clawhub package publisher, publication workflow, registry entry, or a dependency used by a future release.
  2. The attacker publishes a malicious release and causes the mutable latest tag to resolve to it.
  3. A user follows the documented installation command.
  4. npx retrieves and executes the attacker-controlled package without an immutable version or integrity value being specified by the project.
  5. Malicious CLI, lifecycle, or dependency code runs under the account invoking the command.

Impact Assessment

Exploited code would generally inherit the installing user's privileges and environment. Depending on those privileges, it could read or alter user-accessible files, access credentials exposed to the process, modify development configuration, install additional software, or ...[truncated 204 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace @latest with an explicitly reviewed, immutable package version.
  • Commit and enforce a lockfile where the installation workflow supports one.
  • Verify package provenance, signatures, and registry integrity metadata before execution.
  • Review the selected package version and its transitive dependency tree before recommending it.
  • Run installation with the least-privileged account possible and avoid elevated shells.
  • In CI, use an allowlisted internal registry or verified artifact mirror and restrict network, filesystem, and secret access during installation.
  • Keep SKILL.md and README.md synchronized so both use the same pinned and reviewed command.

T08 · Insecure Dependencies

Warning
Location
README.md:25
Finding

Ambiguous Unpinned npm Package Executed During GitHub-Based Installation

Content
View full analysis

Vulnerability Details

File Location: README.md:25-27
Vulnerability Type: Unsafe execution of an unpinned third-party installation utility
Risk Level: Medium

Vulnerable Code

bash
npx add https://github.com/wpank/ai/tree/main/skills/meta/auto-context

Technical Analysis

This command does not directly execute the referenced GitHub repository. Its executable is the npm package resolved for the name add, while the GitHub URL is passed to that package as an argument. No version, integrity hash, or package provenance constraint is specified for add.

A user may reasonably interpret this as installing directly from the displayed repository, while the command first introduces and executes a separate third-party npm package. The safety of the operation therefore depends on the package name resolving to the intended utility and on that utility and its dependency chain remaining uncompromised.

The GitHub URL also references a branch path rather than an immutable commit, so the installation source can change over time. However, the immediate code-execution concern is the unpinned npm executable invoked by npx.

Attack Path

  1. An attacker compromises the npm package resolved as add, its publisher account, its release workflow, or one of its executable dependencies.
  2. Alternatively, package-resolution behavior causes users to receive a package different from the utility the documentation author intended.
  3. The user runs the documented command, believing it installs content directly from the shown GitHub location.
  4. npx downloads and executes the unresolved current version of add.
  5. Attacker-controlled code executes before or while processing the GitHub URL and can perform arbitrary actions permitted to the invoking user.

Impact Assessment

A malicious resolved package could execute with the privileges of the user running npx. It could access user-readable source code and confi ...[truncated 415 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the ambiguous npx add ... instruction unless the exact add package and its security properties have been reviewed.
  • Use a clearly identified installer pinned to an immutable version and verify its integrity and provenance.
  • Pin the repository source to a reviewed commit rather than a mutable branch path.
  • Prefer a transparent manual installation procedure, such as downloading a verified archive or checking out a specific commit and copying the required directory.
  • If an npm-based installer remains necessary, document its full package identity, expected publisher, pinned version, integrity value, and verification procedure.
  • Execute installation in a restricted environment without elevated privileges or unnecessary access to secrets.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
Findings (10)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill description says to automatically read relevant context before major actions and lists many broad situations in which it should activate. In an agent setting, vague trigger boundaries can cause over-collection of files, unintended reading of sensitive project material, and execution drift where the skill runs far more often than users expect.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

The README instructs users to execute npx add against a GitHub URL without pinning to a specific immutable version, tag, or commit. That creates a supply-chain risk because future upstream changes or a compromised publisher/repository could cause different code to be fetched and run than what was originally reviewed.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The command npx clawhub@latest install auto-context explicitly requests the latest version, which is mutable over time. Users may therefore install and execute code that has not been reviewed in this version of the README, increasing exposure to malicious or accidental upstream changes.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 43)May include surrounding context.

From your project root:

bash
mkdir -p .cursor/skills
cp -r ~/.ai-skills/skills/meta/auto-context .cursor/skills/auto-context

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 59)May include surrounding context.

From your project root:

bash
mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/meta/auto-context .claude/skills/auto-context

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 66)May include surrounding context.

Claude Code (global)

bash
mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/meta/auto-context ~/.claude/skills/auto-context

External Model or Provider Selection

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: auto-context
model: fast
description: Automatically read relevant context before major actions. Loads TODO.md, roadmap.md, handoffs, task plans, and other project context files so the AI operates with full situational awareness. Use when starting a task, implementing a feature, refactoring, debugging, planning, or resuming a session.
---

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill directs the agent to automatically read multiple project files, including handoffs and session summaries, before major actions without a user-facing consent or privacy warning. This is dangerous because those files may contain secrets, personal data, internal notes, or unrelated sensitive context that gets ingested and potentially surfaced beyond what is necessary for the task.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The activation rules are intentionally broad and instruct the agent to trigger automatically for many common workflows, increasing the chance of unnecessary file access and context loading without a narrowly scoped need. In this skill's context, that expands exposure to potentially sensitive project files and can normalize over-collection of local data.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.