ClawHub
Back to skill

Security audit

Clawhub Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill appears purpose-aligned, but it asks users to globally install and run an unpinned third-party npm package whose reviewed code is not included.

Review the npm package source and published version before installing, prefer a pinned/local install if possible, and avoid sending confidential or unpublished paper text unless external DashScope processing is acceptable. Confirm which API key is actually required before storing credentials in the global config file.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:11
Finding

Unpinned Global Installation of a Third-Party npm Package

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 11
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Vulnerable Code

bash
npm install -g paperbanana-dashscope

Technical Analysis

The skill instructs users to install the latest available version of paperbanana-dashscope globally without pinning an audited version or verifying package integrity or provenance. The reviewed artifact contains only documentation and metadata; it does not include the npm package's implementation, a lockfile, or integrity hashes. Consequently, the code ultimately installed and executed is outside the auditable scope of this artifact and can change after review.

npm installations may execute package lifecycle scripts, while subsequent CLI use executes package code with the invoking user's privileges. Global installation also increases scope by modifying the user's global npm environment.

Attack Path

  1. An attacker compromises the npm publisher account, package registry path, or a future package release.
  2. The attacker publishes a malicious version under the documented package name.
  3. A user follows the skill's unpinned global installation command.
  4. npm retrieves the attacker-controlled latest release.
  5. Malicious lifecycle scripts may execute during installation, or malicious code executes when the CLI is invoked.
  6. The payload operates with the installing or invoking user's privileges.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the user's privileges. Depending on those privileges and the malicious package implementation, the affected scope could include accessible files, environment variables and API credentials, outbound network access, and modification of the user's global npm environment. No malicious package implementation or active compromise was established in the reviewed files; the risk arises from th ...[truncated 50 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin installation to a specifically reviewed release, for example:

    bash
    npm install -g paperbanana-dashscope@1.0.2

  • Provide and verify the expected package integrity digest and npm provenance before installation.

  • Prefer a project-local, lockfile-controlled installation over a global installation to reduce system-wide impact.

  • Disable lifecycle scripts during installation when they are not required:

    bash
    npm install --ignore-scripts --save-exact paperbanana-dashscope@1.0.2

  • Audit the package source and published tarball for the pinned release, including lifecycle scripts and transitive dependencies.

  • Document a controlled upgrade procedure requiring security review before changing the pinned version.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: paperbanana-dashscope
description: Generate academic figures and scientific diagrams from paper text using a multi-agent pipeline powered by Alibaba Cloud DashScope (Qwen-VL + Wanxiang/Qwen-Image). Use when the user wants to create figures for research papers, visualize methods sections, generate architecture diagrams, or produce illustrations for academic content. Supports diagram and plot tasks with multi-round critic refinement.
---

# paperbanana-dashscope

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill documentation does not warn users that paper text and captions are transmitted to external Alibaba Cloud DashScope models, nor that generated files are written to a user-specified local path. In a research-paper context, inputs may contain unpublished methods, proprietary data descriptions, or other sensitive material, so undisclosed outbound transmission and filesystem writes create meaningful privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest says the skill is powered by Alibaba Cloud DashScope using Qwen-VL and Wanxiang/Qwen-Image, but the only required credential is OPENAI_API_KEY. That creates a clear intent mismatch at the manifest level, because the declared operational dependency does not align with the stated backend/provider.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.