Subagent Development

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:38 PM UTC
• Version: 1.0.0

Overview

The skill's core subagent workflow is coherent, but its install instructions rely on mutable remote commands and document persistent global installation paths.

Review and pin the installer source before installing, prefer a project-scoped install over a global one unless you want this workflow available everywhere, and run it only in repositories where subagents may read code, make edits, run tests, and create commits.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:17

Finding

Unpinned ClawHub Installer Can Execute Mutable Third-Party Code

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:17-20
Vulnerability Type: Unpinned third-party executable dependency
Risk Level: Medium

Vulnerable Code:

bash

### OpenClaw / Moltbot / Clawbot

```bash
npx clawhub@latest install subagent-development

text

### Technical Analysis

The installation instructions invoke `clawhub` through `npx` using the mutable `@latest` version tag. Unlike an exact, reviewed package version, `@latest` can be changed by the package publisher after this Skill has been audited.

Because `npx` retrieves and executes package code, compromise of the package publisher account, registry package, or upstream release process could cause future users to execute attacker-controlled code. The effective installer payload is therefore not fixed to the content reviewed in this audit.

This is a supply-chain weakness rather than evidence that the current upstream package is malicious.

### Attack Path

1. An attacker compromises the `clawhub` package, its publisher account, or its release pipeline.
2. The attacker publishes a malicious package version and assigns it the `latest` distribution tag.
3. A user follows the documented command:
   `npx clawhub@latest install subagent-development`.
4. `npx` retrieves the attacker-controlled version from the package registry.
5. The malicious package executes with the permissions of the user running the installation.
6. Depending on those permissions, the payload could modify project files, access user-readable data, tamper with installed Skills, or run additional local commands.

### Impact Assessment

Successful exploitation provides code execution with the privileges of the user who runs the installation command. For a normal developer account, the scope could include source repositories, user configuration, accessible credentials, and other files owned by that user. If the command is run from an elevated shell or privileged automation environment, the impact could extend to sy
...[truncated 178 chars]

Remediation

View remediation

Remediation Suggestions

• Replace @latest with an exact, reviewed package version, for example clawhub@X.Y.Z.
• Use a lockfile or equivalent integrity mechanism where the installation environment supports one.
• Verify the package checksum, registry provenance, and publisher identity before execution.
• Document a controlled upgrade process in which new versions are reviewed before the pinned version is changed.
• Prefer downloading and inspecting installation tooling before execution in sensitive environments.
• Advise users not to run installation commands with elevated privileges unless explicitly required.

T08 · Insecure Dependencies

Warning

• Location: README.md:23

Finding

README Installation Commands Reference Mutable Remote Sources

Content

View full analysis

Vulnerability Details

File Location: README.md:23-32
Vulnerability Type: Mutable remote installer and unpinned repository dependency
Risk Level: Medium

Vulnerable Code:

bash

## Installation

```bash
npx add https://github.com/wpank/ai/tree/main/skills/meta/subagent-development

OpenClaw / Moltbot / Clawbot

bash

npx clawhub@latest install subagent-development

text

### Technical Analysis

Both documented installation methods depend on mutable remote content:

- The GitHub URL references the `main` branch rather than an immutable commit hash or signed release.
- The ClawHub command uses the mutable `@latest` package tag.

The content obtained by either command can therefore change after the project has been audited. Invoking these sources through `npx` creates a code-execution boundary: users are instructed to retrieve and execute tooling whose future contents are controlled by external package or repository maintainers.

There is no evidence in the reviewed files that the current GitHub repository or package is malicious. The confirmed issue is the absence of version pinning and integrity verification.

### Attack Path

1. An attacker compromises the referenced GitHub repository, package publisher account, registry entry, or associated release pipeline.
2. For the GitHub path, the attacker modifies content reachable through the `main` branch. For the package path, the attacker publishes a malicious release under the `latest` tag.
3. A user copies one of the installation commands from `README.md`.
4. `npx` resolves the mutable remote reference and obtains the modified content.
5. The installation tooling executes in the user's local environment.
6. The payload can perform actions allowed to that user, potentially including source-code modification, installation of altered Skills, access to user-readable files, or execution of secondary payloads.

### Impact Assessment

Exploitation could result in arbitrary code executio
...[truncated 565 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the GitHub main branch reference with a reviewed immutable commit SHA or a cryptographically verified signed release.
• Pin clawhub to an exact version instead of using @latest.
• Publish expected checksums or integrity metadata and require verification before installation.
• Use a trusted package registry and enable package provenance verification where available.
• Review dependency updates before changing the pinned commit or package version.
• Separate download and execution in high-security environments so users can inspect retrieved content before running it.
• Avoid recommending elevated execution and document the minimum permissions required for installation.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The README instructs users to install code directly from a remote GitHub path using npx add without pinning to a specific immutable version or commit. This creates a supply-chain risk because future upstream changes or a compromised source could alter what gets installed, causing users to retrieve unexpected or malicious content.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Using npx clawhub@latest install pulls the latest installer version at execution time, which is not reproducible and exposes users to upstream compromise or breaking changes. If the package or its dependency chain is hijacked, users may execute unintended code during installation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 86% confidence

Finding

The README instructs users to copy the skill into persistent per-project and global agent skill directories, causing the behavior to be automatically available in future sessions. Persistent installation increases risk because any unsafe or later-modified skill content can continue influencing agent behavior beyond the immediate context, especially for a skill designed to orchestrate subagents across development workflows.

Content

Scanner excerpt · README.md (reported line 41)May include surrounding context.

From your project root:

bash

mkdir -p .cursor/skills
cp -r ~/.ai-skills/skills/meta/subagent-development .cursor/skills/subagent-development

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 57)May include surrounding context.

From your project root:

bash

mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/meta/subagent-development .claude/skills/subagent-development

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 64)May include surrounding context.

Claude Code (global)

bash

mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/meta/subagent-development ~/.claude/skills/subagent-development

External Model or Provider Selection

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: subagent-driven-development
model: standard
description: Use when executing implementation plans with independent tasks in the current session
---

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The installation command uses npx clawhub@latest, which fetches and executes the latest published package at install time rather than a fixed, reviewed version. That creates a supply-chain risk: a compromised upstream package, malicious publish, or breaking update could cause arbitrary code execution on the user's machine during installation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

md

"Mark task complete in TodoWrite" [shape=box];
    }

    "Read plan, extract all tasks with full text, note context, create TodoWrite" [shape=box];
    "More tasks remain?" [shape=diamond];
    "Dispatch final code reviewer subagent for entire implementation" [shape=box];
    "Use superpowers:finishing-a-development-branch" [shape=box style=filled fillcolor=lightgreen];

Static analysis

No suspicious patterns detected.