ClawHub
Back to skill

Security audit

Magic Quill

Security checks for vulnerabilities and agentic risk

Overview

This skill generally does what it claims, but it fetches broad arbitrary URLs and documents unpinned installs, so it belongs in Review before use.

Before installing, prefer a pinned audited commit or release instead of the floating npx commands. Use this only with trusted public topics or URLs, avoid localhost, intranet, cloud metadata, or credential-bearing pages, keep --out under spells/, and review the separate spellbook hook before installing it.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/generate-spell-mapping.mjs:1576
Finding

Unrestricted URL Fetching Enables Server-Side Request Forgery

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:65
Finding

Installation Instructions Use Mutable, Unpinned Remote Dependencies

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · scripts/generate-spell-mapping.mjs (reported line 385)May include surrounding context.

js
delete: "Scuttle",
        deploy: "Set Sail",
        fix: "Patch",
        monitor: "Spyglass",
        default: "Crew"
      },
      objects: {
        web: "the Horizon",
        file: "the Captain's Log",
        code: "the Map",
        process: "the Cannons",
        repo: "the Hold",
        task: "the Voyage",
        default: "the Voyage"
      },
      icons: {
        default: "🏴‍☠️",
        deploy: "⛵",
        monitor: "🔭"
      },
      suffixes: ["Kraken", "Reef", "Tempest", "Harbor", "Treasure"]
    }
  },
  {
    match: /(marvel|dc\b|avengers|x-men|superhero|batman|superman|spider-man|iron\s*man)/i,
    profile: {
      id: "superhero",
      verbs: {
        search: "Detect",
        read: "Brief",
        write: "Draft",
        create: "Assemble",
        fix: "Stabilize",
        debug: "Expose",
        deploy: "Launch",
        kill: "Neutralize",
        default: "Activate"
      },
      objects: {
        web: "the Network",
        file: "t

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

The skill instructs users to run npx skills add ... without pinning a specific package version, which can cause execution of whatever package version is current at install time. If the upstream package or dependency chain is compromised, users may unknowingly execute malicious code during installation or receive altered behavior later.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

This line again references npx skills add with an unpinned source, so the install target can change over time and may resolve to a compromised or unexpected package state. Because npx executes fetched code, this creates a supply-chain exposure rather than a merely informational issue.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

The installation command uses npx skills add wynnsu/openclaw-spellbook without any version pinning, so consumers will retrieve the latest state of that package/repository at execution time. In a skill that already performs dynamic fetching and writes files, supply-chain compromise would increase the chance of delivering harmful code or instructions through a trusted workflow.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

This command points npx skills add at a repo subpath without pinning an immutable revision, leaving the fetched code subject to upstream changes or compromise. Since npx may download and execute code immediately, an attacker controlling the source or its dependencies could gain code execution on the user's system.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/generate-spell-mapping.mjs (reported line 1841)May include surrounding context.

js
const endpoints = [
    "https://wry-manatee-359.convex.site/api/v1/skills",
    "https://clawhub.ai/api/v1/skills",
    "https://api.clawhub.ai/v1/skills"
  ];

  let lastError = null;

Static analysis

No suspicious patterns detected.