ClawHub
Back to skill

Security audit

justin-sun-writing

Security checks for vulnerabilities and agentic risk

Overview

This is a writing-style skill with no executable code, hidden behavior, credential access, or persistence beyond normal installation.

Before installing, prefer a reviewed registry version or a pinned commit instead of a mutable main-branch URL. Once installed, this skill should only affect writing assistance and should not need access to private files, credentials, or external services.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:11
Finding

Unpinned Skill Installation from Mutable Remote Sources

Content
View full analysis

Vulnerability Details

File Location: README.md, lines 11–14
Vulnerability Type: Supply-chain risk caused by unpinned remote Skill installation
Risk Level: Medium

markdown
| OpenClaw | `openclaw skills install @0xcjl/justin-sun-writing` |
| Codex | Copy `SKILL.md` to `~/.codex/skills/justin-sun-writing/SKILL.md`. |
| Claude Code | Copy `SKILL.md` to `~/.claude/skills/justin-sun-writing/SKILL.md`, or the equivalent project `.claude/skills/` path. |
| Hermes | `hermes skills install https://raw.githubusercontent.com/0xcjl/justin-sun-writing/main/SKILL.md --name justin-sun-writing` |

Technical Analysis

The OpenClaw installation command does not identify an immutable package version, while the Hermes command downloads SKILL.md directly from the mutable main branch. Neither command includes integrity verification through a cryptographic checksum or signature.

Consequently, the content installed later may differ from the package reviewed during this audit. A repository or publisher-account compromise could replace the legitimate Skill instructions with attacker-controlled content. Because Skill instructions influence agent behavior, malicious changes could redirect agent objectives, request unsafe tool operations, or attempt to weaken safety constraints.

This finding concerns the installation supply chain. The currently audited SKILL.md contains no malicious payload, executable code, credential access, persistence mechanism, or unsafe tool invocation.

Attack Path

  1. An attacker compromises the upstream repository, publisher account, registry entry, or release process.
  2. The attacker modifies the mutable main branch or replaces the unversioned registry package with a malicious SKILL.md.
  3. A user follows one of the documented installation commands.
  4. The installer retrieves the modified content rather than the version reviewed in this audit.
  5. The user's agent loads and follows the ...[truncated 803 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace mutable branch URLs with immutable URLs pinned to a reviewed commit SHA.
  2. Pin the OpenClaw installation command to a specific, reviewed package version where the registry supports version constraints.
  3. Publish a SHA-256 or stronger digest for the exact SKILL.md artifact and instruct users or installers to verify it before activation.
  4. Prefer signed releases or a registry mechanism that verifies publisher and artifact signatures.
  5. Document a reproducible process for comparing the downloaded file against the audited source.
  6. Treat updates as new artifacts requiring review rather than automatically following main or another mutable reference.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 12)May include surrounding context.

md
| Platform | Installation |
|---|---|
| OpenClaw | `openclaw skills install @0xcjl/justin-sun-writing` |
| Codex | Copy `SKILL.md` to `~/.codex/skills/justin-sun-writing/SKILL.md`. |
| Claude Code | Copy `SKILL.md` to `~/.claude/skills/justin-sun-writing/SKILL.md`, or the equivalent project `.claude/skills/` path. |
| Hermes | `hermes skills install https://raw.githubusercontent.com/0xcjl/justin-sun-writing/main/SKILL.md --name justin-sun-writing` |

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 13)May include surrounding context.

md
| Platform | Installation |
|---|---|
| OpenClaw | `openclaw skills install @0xcjl/justin-sun-writing` |
| Codex | Copy `SKILL.md` to `~/.codex/skills/justin-sun-writing/SKILL.md`. |
| Claude Code | Copy `SKILL.md` to `~/.claude/skills/justin-sun-writing/SKILL.md`, or the equivalent project `.claude/skills/` path. |
| Hermes | `hermes skills install https://raw.githubusercontent.com/0xcjl/justin-sun-writing/main/SKILL.md --name justin-sun-writing` |