ClawHub
Back to skill

Security audit

Estimation Patterns

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only estimation skill with no hidden runtime behavior; the main caveat is unpinned remote install commands.

This skill appears safe to use as estimation guidance. Before installing, prefer a pinned and trusted installer version or manual installation from a reviewed commit instead of mutable @latest or main-branch commands, especially on machines with developer credentials.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:17
Finding

Unpinned Remote npm Package Execution in Skill Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 17
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable Code:

bash
npx clawhub@latest install estimation-patterns

Technical Analysis

The installation procedure uses npx to retrieve and execute the mutable latest release of the third-party clawhub package. Because neither an immutable version nor an integrity digest is specified, the code executed by this command can change after the Skill has been reviewed.

The repository does not contain or constrain the implementation, lifecycle scripts, or transitive dependencies executed through this command. A compromised package release, maintainer account, npm registry response, or transitive dependency could therefore introduce arbitrary behavior into the installation process.

This is a supply-chain exposure and does not establish that the current clawhub package is malicious.

Attack Path

  1. An attacker compromises the package, a maintainer account, or a dependency used by a future clawhub release.
  2. The compromised release becomes the version resolved by the mutable @latest tag.
  3. A user follows the documented installation command.
  4. npx downloads and executes the compromised package or its lifecycle behavior.
  5. The payload runs with the permissions of the user who invoked the command.

Impact Assessment

Successful exploitation could permit arbitrary command execution under the installing user's account. Depending on that account's permissions and environment, the payload could read or modify project files, access developer credentials and environment variables, change local development configuration, install additional dependencies, or initiate outbound network connections.

The command does not itself request elevated privileges, so the directly obtainable privilege level is limited to that of the invoking user. The practical ...[truncated 117 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace @latest with a specific, reviewed package version.
  • Commit and enforce an appropriate lockfile with verified integrity metadata.
  • Document the expected package source, publisher, version, and installation-side filesystem changes.
  • Verify package provenance and signatures where the registry and tooling support them.
  • Run installation in a restricted environment without production credentials or unnecessary filesystem access.
  • Consider npx --ignore-scripts where compatible, after verifying that disabling lifecycle scripts does not break the installer.
  • Periodically review pinned versions and update them through a controlled dependency-review process.

T08 · Insecure Dependencies

Warning
Location
README.md:26
Finding

Mutable and Unverified Remote Installers in README

Content
View full analysis

Vulnerability Details

File Location: README.md, lines 26-35
Vulnerability Type: Unsafe remote package sources and unpinned npm execution
Risk Level: Medium

Vulnerable Code:

markdown
## Installation

```bash
npx add https://github.com/wpank/ai/tree/main/skills/meta/estimation-patterns

OpenClaw / Moltbot / Clawbot

bash
npx clawhub@latest install estimation-patterns
text

### Technical Analysis

Both documented installation alternatives rely on remotely retrieved executable npm tooling without immutable version or integrity constraints.

The first command invokes the npm package named `add` through `npx` and supplies content hosted at a GitHub path on the mutable `main` branch. Neither the executable installer nor the repository content is pinned to a reviewed version or commit. The effective installation behavior may therefore change independently of this audited project.

The second command explicitly resolves the mutable `@latest` release of `clawhub`. Its executable implementation, lifecycle scripts, and transitive dependency graph are outside the reviewed files.

These commands create a supply-chain trust boundary in which changes to npm packages, maintainer accounts, dependencies, or mutable remote repository content can affect code executed during installation. This finding represents insecure dependency handling; it is not evidence that the currently referenced packages or repository are malicious.

### Attack Path

1. An attacker compromises the `add` or `clawhub` package, one of their maintainers or dependencies, or the referenced GitHub repository.
2. The attacker publishes a malicious package release or modifies content reachable through the mutable `main` branch.
3. A user copies one of the documented `npx` commands.
4. npm resolves and downloads the current remote executable and associated dependencies.
5. The compromised installer, lifecycle script, or depende
...[truncated 771 chars]
Remediation
View remediation

Remediation Suggestions

  • Replace mutable package references with exact, reviewed versions.
  • Replace the GitHub main branch URL with an immutable commit reference or a verified release artifact.
  • Avoid the ambiguous npx add workflow; provide a clearly identified, audited installer or a manual installation method from pinned content.
  • Record and verify cryptographic integrity metadata for downloaded artifacts where supported.
  • Use lockfiles for npm dependency resolution and review transitive dependency changes before updates.
  • Document the installer publisher, source repository, expected operations, and files created or modified.
  • Use --ignore-scripts when compatible and require explicit review before enabling package lifecycle scripts.
  • Recommend installation from a sandboxed or least-privilege environment without sensitive credentials.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 44)May include surrounding context.

From your project root:

bash
mkdir -p .cursor/skills
cp -r ~/.ai-skills/skills/meta/estimation-patterns .cursor/skills/estimation-patterns

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 60)May include surrounding context.

From your project root:

bash
mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/meta/estimation-patterns .claude/skills/estimation-patterns

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 67)May include surrounding context.

Claude Code (global)

bash
mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/meta/estimation-patterns ~/.claude/skills/estimation-patterns

External Model or Provider Selection

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: estimation-patterns
model: standard
description: Practical estimation techniques for software tasks — methods comparison, decomposition, complexity multipliers, buffer calculation, bias awareness, and communication strategies. Use when estimating features, sprint planning, or presenting timelines to stakeholders.
---

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The installation command uses npx clawhub@latest install estimation-patterns, which pulls and executes the latest published package version at runtime rather than a pinned, reviewed version. This creates a supply-chain risk: if the upstream package is compromised or a breaking/malicious release is published, users of the skill could execute attacker-controlled code during installation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.