Subagent Driven Development

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 4:40 PM UTC
• Version: 0.1.0

Overview

This skill is a disclosed workflow for using subagents to implement and review coding tasks, with a notable caution around its unpinned npx installation command.

Install only if you are comfortable with an agent making code changes, running tests, creating commits, and dispatching multiple subagents from a plan. Prefer a pinned or otherwise verified installer version instead of the documented @latest command, and review the implementation plan carefully before using the no-human-in-the-loop workflow.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:20

Finding

Execution of an Unpinned Package from a Mutable Release Tag

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 20
Vulnerability Type: Unpinned third-party package execution through npx
Risk Level: Medium

Vulnerable Code Snippet:

bash

npx clawhub@latest install subagent-driven-development

Technical Analysis

The documented installation command instructs users to download and execute the npm package identified by the mutable latest tag. Because neither an immutable package version nor an integrity value is specified, the code executed by this command can change after the skill has been reviewed.

npx may retrieve the selected package from the configured npm registry and execute its command with the privileges of the invoking user. The security of the installation process therefore depends on the package publisher account, registry configuration, package ownership, and whichever release currently resolves from latest. The supplied project does not provide a lockfile, checksum, signature, or other mechanism that binds installation to a reviewed artifact.

No evidence establishes that the current package is malicious. The vulnerability is the unsafe, mutable supply-chain execution pattern.

Attack Path

1. An attacker compromises the package publisher account, package ownership, registry resolution, or another relevant release mechanism.
2. The attacker publishes a malicious package release and causes the latest tag to resolve to it.
3. A user follows the installation command in SKILL.md.
4. npx downloads and executes the attacker-controlled package.
5. The malicious package runs with the invoking user's privileges and can access resources available to that account.

Impact Assessment

Successful exploitation can provide arbitrary code execution under the account running the installation command. Depending on that account's privileges and environment, the payload could read or modify project files, access user-readable credentials ...[truncated 369 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the mutable latest tag with an explicitly reviewed and immutable package version, for example:

   bash

   npx clawhub@<reviewed-version> install subagent-driven-development
   

2. Verify the package's expected registry, publisher, and ownership before installation.

3. Where supported, validate package provenance, signatures, or integrity hashes before execution.

4. Use a lockfile or equivalent dependency-pinning mechanism when integrating the package into a managed project.

5. Avoid running the installer with administrator or root privileges.

6. Execute installation in an isolated environment with no unnecessary credentials or sensitive host mounts.

7. Establish a controlled update process in which new versions are reviewed before the documented version is changed.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

External Model or Provider Selection

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: subagent-driven-development
model: standard
description: Execute implementation plans by dispatching a fresh subagent per task with two-stage review (spec compliance then code quality). Use when you have an implementation plan with mostly independent tasks and want high-quality, fast iteration within a single session.
version: 1.0.0
---

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The installation command uses npx clawhub@latest, which fetches and executes the newest package version at runtime rather than a pinned, reviewed release. This creates a supply-chain risk: a compromised upstream package, malicious publication, or breaking update could execute arbitrary code on the user's machine during install.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

Example Workflow

text

Controller: Reading plan — 5 tasks extracted, TodoWrite created.

─── Task 1: Hook installation script ───

Static analysis

No suspicious patterns detected.