Startup Metrics

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:38 PM UTC
• Version: 1.0.0

Overview

The skill is a startup metrics reference guide at runtime, but its installation instructions ask users to run mutable remote npx commands that can change after review.

Review the skill content itself as a benign metrics guide, but avoid running the documented mutable installer commands in a sensitive environment. Prefer a pinned ClawHub version or immutable Git commit, and install without elevated privileges after inspecting the downloaded artifact.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:17
• Finding: Unpinned npm Package Execution Through npx## Vulnerability Details **File Locations**: - `SKILL.md:17-21` - `README.md:30-35` **Vulnerability Type**: Execution of a mutable third-party dependency during installation **Risk Level**: Medium **Vulnerable Code Snippets**: `SKILL.md:17-21` ```markdown ### OpenClaw / Moltbot / Clawbot ```bash npx clawhub@latest install startup-metrics ``` ``` `README.md:30-35` ```markdown ### OpenClaw / Moltbot / Clawbot ```bash npx clawhub@latest install startup-metrics ``` ``` ### Technical Analysis The documented installation procedure invokes `clawhub@latest` through `npx`. The `latest` npm distribution tag is mutable and does not identify an immutable, previously audited package version. `npx` may download and execute the selected package, including its CLI implementation and applicable npm lifecycle behavior, with the permissions of the user performing the installation. Consequently, the code ultimately executed by this command can change after the skill itself has been reviewed. The project does not provide a fixed version, lockfile, integrity digest, signature, or other mechanism that allows users to verify that they are executing the same package that was originally intended. This is a supply-chain exposure rather than evidence that the current `clawhub` package is malicious. ### Attack Path 1. An attacker compromises the npm publisher account, package release process, registry entry, or another relevant upstream component. 2. The attacker publishes a malicious version and assigns it to the `latest` distribution tag. 3. A user follows the documented `npx clawhub@latest install startup-metrics` instruction. 4. `npx` retrieves the attacker-controlled release. 5. The downloaded CLI or associated package behavior executes with the installing user's privileges. 6. The payload can access or modify resources available to that user. ### Impact Assessment Successful exploitation could provide arbi ...[truncated 548 chars]
• Remediation: ## Remediation Suggestions 1. Replace `@latest` with a specifically reviewed package version, for example `clawhub@X.Y.Z`. 2. Prefer an immutable package reference and verify the expected npm integrity digest before execution. 3. Document the trusted publisher, expected version, and checksum or signature. 4. Use lockfiles where the installation workflow supports them. 5. Test updates in an isolated environment and review package provenance before changing the pinned version. 6. Keep `SKILL.md` and `README.md` synchronized so neither reintroduces an unpinned installation command. 7. Advise users not to run the installer with elevated privileges.

T08 · Insecure Dependencies

Warning

• Location: README.md:25
• Finding: Mutable GitHub Source Passed to an Executed npm CLI## Vulnerability Details **File Location**: `README.md:25-28` **Vulnerability Type**: Unpinned remote source retrieval through an npm-executed installer **Risk Level**: Medium **Vulnerable Code Snippet**: ```markdown ## Installation ```bash npx add https://github.com/wpank/ai/tree/main/skills/product/startup-metrics ``` ``` ### Technical Analysis The installation instruction runs the npm package or command named `add` through `npx` and passes it a GitHub URL that references the mutable `main` branch. Neither the executed npm package nor the GitHub content is pinned to an immutable version or commit. This creates two independently mutable trust points: 1. The package resolved by `npx add` can change through a new npm release or publisher compromise. 2. The content at the GitHub `main` branch can change after this audit. The repository provides no checksum, signature, fixed npm version, or Git commit hash for verifying either component. Therefore, following this instruction may execute or install content different from the material that was reviewed. This finding identifies an unsafe supply-chain design; it does not establish that the current npm package or GitHub repository is malicious. ### Attack Path 1. An attacker compromises the npm package used by `npx add`, the relevant npm publisher account, the referenced GitHub account or repository, or its release workflow. 2. The attacker publishes malicious installer behavior or commits malicious skill content to the referenced `main` branch. 3. A user executes the installation command from the README. 4. `npx` resolves and executes the mutable npm CLI. 5. The CLI retrieves content from the mutable GitHub branch. 6. Attacker-controlled installer logic executes immediately, or attacker-controlled skill content is installed and later loaded by an agent. 7. The malicious content operates within the permissions available to the installer or agent process. ### I ...[truncated 643 chars]
• Remediation: ## Remediation Suggestions 1. Replace the mutable GitHub branch URL with an immutable, reviewed commit reference. 2. Pin the npm CLI invoked through `npx` to a specific reviewed version. 3. Verify the downloaded artifact using a published cryptographic checksum or signature before installation. 4. Replace the ambiguous `npx add` workflow with an explicitly documented and trusted installer whose package name, version, publisher, and expected behavior are clear. 5. Download and inspect remote skill content before copying it into an agent's active skill directory. 6. Perform installation in a sandbox or least-privileged environment without production credentials. 7. Establish a controlled update process that reviews new commits and package versions before updating the pinned references.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence
• Finding: The README instructs users to execute remote package tooling via `npx add` against a GitHub URL without pinning to an immutable version or commit. That creates a supply-chain risk: if the referenced content changes or the resolver pulls unexpected code, users may execute different code than intended.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence
• Finding: `npx clawhub@latest install startup-metrics` uses the `latest` tag, which is mutable and may resolve to different code over time. If the upstream package is compromised or a breaking/malicious version is published, users following the README could execute attacker-controlled code.

Session Persistence

Medium

• Category: Rogue Agent

Content

From your project root:

```bash
mkdir -p .cursor/skills
cp -r ~/.ai-skills/skills/product/startup-metrics .cursor/skills/startup-metrics
```

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

From your project root:

```bash
mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/product/startup-metrics .claude/skills/startup-metrics
```

• Confidence: 85% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

#### Claude Code (global)

```bash
mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/product/startup-metrics ~/.claude/skills/startup-metrics
```

• Confidence: 85% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

External Model or Provider Selection

Medium

• Category: Excessive Agency

Content

---
name: startup-metrics
model: fast
version: 1.0.0
description: >
  Track, calculate, and optimize key performance metrics for startups from seed

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: The installation command uses `npx clawhub@latest install startup-metrics`, which pulls and executes a mutable latest package version. That creates a supply-chain risk: if the upstream package is compromised or a breaking/malicious version is published, users may execute attacker-controlled code during installation.

Static analysis

No suspicious patterns detected.