ClawHub
Back to skill

Security audit

alphaclaw

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent SkillHub CLI guide, but it asks users to install a third-party npm tool that handles account keys and can modify or publish skills.

Before installing, verify that the 1688alphaclaw npm package and AlphaShop/SkillHub domains are the ones you intend to trust. Use revocable or least-privilege AK/SK credentials where possible, protect ~/.alphaclaw/auth.json, and review commands carefully before using --force or --yes because they can overwrite local skills or publish content with less review.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The trigger conditions are broad enough to activate on generic requests like installing, searching, or managing skills, which can cause this skill to intercept user intent that may not specifically target AlphaClaw. In a tool that performs installation, publishing, authentication, and remote API interactions, over-triggering increases the chance of unintended execution paths, credential prompts, or steering users toward this ecosystem without clear intent.

Static analysis

No suspicious patterns detected.