Ai Freelance Helper

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 3:24 AM UTC
• Version: 1.0.2

Overview

This skill is a straightforward freelance pricing and project helper, but users should understand that it stores business/client data locally and its install command uses a mutable latest package tag.

Install only from a trusted ClawHub/npm source, preferably with a pinned installer version. Treat the local project, client, config, and contract files as sensitive business records, and avoid putting unnecessary personal data or confidential contract text into the tool unless your local workspace is protected.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:25

Finding

Unpinned Package Execution in Installation Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 25
Vulnerability Type: Supply-chain risk caused by execution of a mutable package release
Risk Level: Medium

Vulnerable Code Snippet:

bash

npx clawhub@latest install ai-freelance-helper

Technical Analysis

The documented installation command instructs users to execute the latest release of the clawhub npm package. The latest distribution tag is mutable and does not identify a specific, previously audited artifact. The project also provides no lockfile, package integrity hash, or other mechanism that constrains the installer to a known release.

npx can download and execute package-provided code. Consequently, the code executed by this command may differ from the code that existed when the skill was audited. This creates a supply-chain trust boundary outside the reviewed project.

This finding does not establish that the current clawhub package is malicious. The vulnerability is the unsafe reliance on an unpinned, externally controlled executable package version.

Attack Path

1. An attacker compromises the upstream npm package, a maintainer account, the package publication workflow, or another component of the relevant distribution chain.
2. The attacker publishes a modified release and assigns it to the mutable latest distribution tag.
3. A user follows the installation instructions in SKILL.md.
4. npx resolves clawhub@latest, downloads the attacker-controlled release, and executes its package entry point or lifecycle behavior.
5. The malicious package performs actions with the permissions of the user running the command.

Impact Assessment

Successful exploitation can provide arbitrary code execution under the installing user's account. Depending on that user's permissions and environment, an attacker could read or modify user-accessible files, access environment variables and development credentials, alter the ...[truncated 342 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the mutable latest tag with an exact, reviewed package version, for example:

   bash

   npx clawhub@X.Y.Z install ai-freelance-helper
   

2. Verify the selected package release and its provenance before recommending it.

3. Where supported, validate the downloaded artifact against a published integrity hash or signed release.

4. Use a trusted, explicitly configured package registry and protect package publication accounts with strong authentication and restricted release permissions.

5. Establish an update process in which new installer versions are reviewed and tested before the pinned version in the documentation is changed.

6. Advise users not to execute the installer with elevated privileges unless they have independently verified the package and elevation is strictly necessary.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The install command uses npx clawhub@latest, which pulls whatever version is current at execution time rather than a reviewed, immutable release. This creates a supply-chain risk: a compromised or malicious upstream publish could execute arbitrary code on the user's machine during installation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill states that client, project, and contract data are stored under a local workspace path but does not clearly warn that this may include sensitive business and personal information. Users may unknowingly place customer data, budgets, emails, deadlines, and contract text into unencrypted local files, increasing exposure through local compromise, backups, sync services, or shared machines.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill advertises fetching and analyzing arbitrary third-party web pages without warning the user about external network access, possible transmission of visited URLs/content to connected tools, or the risk of processing untrusted page content. In this context, users may expose browsing targets or business intent and may cause the agent to ingest adversarial content from external sites.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code presents its user-facing description and CLI help entirely in Chinese, and there is no indication that users can opt into another language or that the skill is intentionally limited to a Chinese-speaking region. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill accesses user-local configuration and stored project/client data under the home directory, and the CLI explicitly exposes configuration and project contents via the config and projects commands. That exceeds the narrow observable purpose of analyzing ad-hoc requirements text for quoting, creating unnecessary access to potentially sensitive personal or business data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The usage and help output shown to end users is only in Chinese, with no visible option to select another language. Because this is a general-purpose CLI helper rather than a clearly justified region-specific tool, this violates the language/locale policy.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This is a manifest file, so vague-trigger rules apply. The description lists broad capabilities like opportunity identification, smart pricing, and project management, but provides no specific trigger phrases, scope boundaries, or exclusion conditions, which could cause the skill to match common freelance-related conversations too broadly.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The natural-language metadata presents the skill in Chinese ('AI 接单助手') and identifies the author as 'OpenClaw CN', which suggests a language/locale constraint. There is no indication that users can opt into another language or that the Chinese-only presentation is a documented region-specific requirement.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The path and filename indicate a YAML configuration file (freelance-config.yaml), but loadConfig uses JSON.parse and saveConfig uses JSON.stringify. This is a direct contradiction between the code's documented file format and its actual behavior, which can mislead developers and operators about how the skill stores configuration.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.