Skill Install Bridge

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:46 AM UTC
• Version: 0.1.0

Overview

This skill coherently generates install snippets and local output files, with ordinary caution needed around generated npx install commands and chosen output folders.

Installers should treat this as a local snippet generator. Run it only with skill details you trust, review the generated files before publishing them, avoid shared or untrusted output folders, use `--force` only when you mean to replace files, and remember that the generated `npx` command should be run only when you trust the ClawHub CLI package source.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:43

Finding

Unverified Third-Party Package Execution Through Generated Installation Commands

Content

View full analysis

`. - Include a no-install fallback: inspect the skill page and copy the usage prompt. - Do not claim downloads, stars, ratings, or review status unless provided. ``` The corresponding command is generated in `scripts/install_bridge.py`, line 44: ```python command = f"npx --yes clawhub@0.9.0 install {slug}" ``` ### Technical Analysis The Skill generates documentation that instructs users to invoke `npx` with the `--yes` option. This causes npm to retrieve and execute `clawhub@0.9.0` without an interactive installation confirmation. Pinning the package version reduces unexpected version drift, but it does not verify the integrity or provenance of the retrieved artifact. The generated command does not specify an expected package digest, a verified local artifact, or an explicitly trusted registry. Its security therefore depends on the npm registry, package maintainer account, package metadata, and client-side registry configuration. The project itself does not fetch or execute this dependency. The exposure occurs when a user follows the generated installation instructions. ### Attack Path 1. An attacker compromises the publisher account, package distribution infrastructure, or registry path used to resolve `clawhub@0.9.0`. 2. Alternatively, an attacker influences the user's npm registry configuration so that the package resolves from an untrusted registry. 3. The Skill generates the command `npx --yes clawhub@0.9.0 install `. 4. A user copies and runs the generated command. 5. `npx` downloads the resolved package and executes its entry point without an interactive confirmation. 6. Malicious package ...[truncated 803 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/install_bridge.py:138

Finding

Symlink-Following Output Writes Can Overwrite Files Outside the Output Directory

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · scripts/install_bridge.py (reported line 141)May include surrounding context.

python

def write(path, text, force=False):
    path.parent.mkdir(parents=True, exist_ok=True)
    if path.exists() and not force:
        raise SystemExit(f"Refusing to overwrite existing file without --force: {path}")
    path.write_text(text, encoding="utf-8")

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill metadata does not declare any explicit tool scope or permissions, yet the skill instructs the agent to run a bundled Python script and references reading and writing generated artifacts. That creates an authority gap where an agent may perform file-write and potentially network-relevant actions without a clearly bounded permission model, increasing the chance of unintended side effects or overbroad execution.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The default prompt instructs the agent to invoke the skill and run a script using 'real' parameters without defining clear conditions for when that action is appropriate. Broad auto-invocation language can cause the agent to use the skill in unintended contexts, increasing the risk of prompt-trigger abuse, accidental execution pathways, or misuse with untrusted input.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.