Popular Skill Scout

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:04 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a coherent recommendation helper, but it can lead an agent into unpinned package execution and installing/running third-party skills without strong safety framing.

Install only if you are comfortable with a skill that may use live marketplace lookups and can suggest trial-installing other skills. Before allowing any CLI fallback or trial run, ask the agent to avoid unpinned `npx`, describe the exact commands and skills it will install, and use a disposable or tightly scoped environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/sources-and-queries.md:72

Finding

Unpinned ClawHub Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: references/sources-and-queries.md, lines 72–81
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Complete Code Snippet:

markdown

## ClawHub CLI fallback

Use only after checking the ClawHub website and GitHub website.

Examples:

- `npx clawhub search "github"`
- `npx clawhub search "repo"`
- `npx clawhub search "browser"`
- `npx clawhub search --sort installs`

The same unsafe dependency-execution pattern is introduced in SKILL.md, line 16:

markdown

3. ClawHub CLI such as `npx clawhub search`

Technical Analysis

The skill instructs the agent to invoke the clawhub npm package through npx without pinning a reviewed version or requiring package integrity and provenance verification. If the package is not already installed, npx can retrieve and execute the version currently resolved by the npm registry.

This creates a mutable supply-chain execution boundary: the package code executed in a future skill run may differ from the code that existed when the skill was audited. Package lifecycle scripts or the CLI implementation itself could execute arbitrary local commands. Exploitation would require the resolved package or its distribution channel to be compromised, maliciously replaced, or otherwise unsafe.

Attack Path

1. ClawHub and GitHub website searches fail to provide sufficient results or are considered inconvenient.
2. The agent follows the documented CLI fallback.
3. The agent executes an instruction such as npx clawhub search "github".
4. npx resolves and potentially downloads a mutable, unpinned package from the npm registry.
5. Malicious package lifecycle or runtime code executes with the permissions and environment of the agent process.
6. That code can access resources available to the current user and agent runtime.

Impact Assessment

Successful exploitation could provide arbitr ...[truncated 448 chars]

Remediation

View remediation

Remediation Suggestions

• Prefer browser-based ClawHub queries and remove automatic npx execution from the fallback workflow.
• If CLI execution is necessary, require explicit user consent before downloading or running a package.
• Pin the CLI to a specific reviewed version rather than resolving the latest mutable release.
• Verify the package name, publisher, repository provenance, lockfile metadata, and registry integrity information before execution.
• Disable npm lifecycle scripts where compatible, and review the package contents before first use.
• Execute the CLI in a restricted sandbox or disposable container with minimal filesystem access, no unnecessary credentials, and constrained network permissions.
• Document the exact trusted installation procedure instead of presenting bare npx clawhub commands.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The skill instructs use of npx clawhub search without pinning a specific package version or integrity-checked source. Because npx fetches and executes code, this creates a supply-chain risk where a compromised latest release, typosquat, or upstream account takeover could lead to arbitrary code execution in the analyst's environment.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill expands from recommending third-party skills into installing and running them with realistic requests. That shifts a low-risk discovery workflow into execution of untrusted third-party code/instructions, increasing exposure to malicious skill behavior, prompt injection, hidden system changes, and data access beyond what a recommendation skill should require.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trial-install and live-verification flow lacks an explicit warning that it may install software, modify the environment, or execute untrusted third-party instructions. Users may consent to 'validation' without understanding that system state, credentials, files, or network access could be affected, which undermines informed consent and safe handling of risky actions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The template recommends very broad single-word queries like repo, file, search, and workflow, which can match large portions of a marketplace and cause the agent to retrieve irrelevant or unintended skills. In a skill-discovery context, this increases the chance of selecting over-privileged, unrelated, or adversarial skills because the search terms are not tightly bound to the user's actual need.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The outcome-based examples such as find skills, manage github, and project planning are still broad enough to return many loosely related skills without meaningful scope constraints. Because this skill is specifically designed to scout and recommend installable skills from ClawHub and GitHub, overly broad discovery queries materially raise the risk of surfacing unsafe, irrelevant, or excessively privileged candidates to the user.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The skill documentation instructs use of npx clawhub without pinning a specific package version. npx will fetch and execute the latest published package if it is not already installed, which creates a supply-chain risk: a compromised or malicious new release could be executed in the user's environment. In this skill context, the command is presented as an endorsed fallback workflow, which makes accidental execution more likely.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

This line recommends npx clawhub without a pinned version, allowing execution of whatever version is current in the registry at runtime. That exposes users to package takeover, malicious updates, or dependency compromise. Because this file is an operational source-of-truth for how the agent should discover skills, the unsafe pattern is more dangerous than a casual mention.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

Using npx clawhub without version pinning means the package resolution is non-deterministic and may execute newly published code from the registry. If an attacker compromises the package or its release pipeline, users following the documented fallback could run malicious code locally. The skill's explicit examples increase trust and the chance of execution.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The npx clawhub search --sort installs example invokes an unpinned package, creating a classic supply-chain execution risk. npx can download and run the latest package version, so a malicious or hijacked release could lead to arbitrary code execution in the user's environment. Since the document frames this as an approved fallback step, the unsafe practice is actionable and credible.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The manifest description says to use the skill when the user asks for 'useful skills' or 'ClawHub recommendations,' which are broad phrases that could match many casual discovery requests without clearly delimiting scope. It does not provide exclusion conditions or negative examples to clarify when this skill should not activate.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The file states 'Use GitHub as a second-pass validator, not the primary ranking source,' which implies GitHub should mainly corroborate ClawHub discoveries. Later output instructions require listing each candidate's source as 'ClawHub or GitHub,' indicating GitHub can also be a direct recommendation source, which contradicts the earlier stated intent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.