ClawHub
Back to skill

Security audit

Verify Skill Safety Before Install

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed pre-install safety checker for other skills, with a documentation mismatch in its verdict format but no hidden scripts or malicious behavior in the inspected artifact.

Before relying on this skill for automated install decisions, make sure your agent treats both verdict schemes consistently and blocks on suspicious findings. Also review the separate clawphylax plugin before installing it, since this skill depends on that plugin for full functionality.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Credential Access

High
Category
Privilege Escalation
Content
---
name: clawphylax-verify
description: "Is this skill safe? Use this before installing any third-party ClawHub skill or running its scripts, and whenever the user asks whether a skill is safe. Inspects every file in the skill folder — SKILL.md and scripts — and reports every network host contacted, whether data or files are uploaded (curl -d/-T, requests.post, scp), and whether credential paths such as ~/.ssh, .env or ~/.aws are read. Returns exactly CLEAN, REVIEW or SUSPICIOUS with file and line; do not recommend installation on SUSPICIOUS. Do not use to judge a running skill's behavior — use skill-network-audit for that."
homepage: https://github.com/aeneassoft/clawphylax
license: MIT
metadata:
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Description-Behavior Mismatch

Medium
Confidence
96% confidence
Finding
The skill metadata promises one exact contract (CLEAN/REVIEW/SUSPICIOUS), but the body later instructs a different output schema using ACTION: INSTALL_OK / REVIEW_WITH_USER / DO_NOT_INSTALL and lowercase verdict terms. For a verification skill, this inconsistency is security-relevant because downstream agents or users may mis-handle a suspicious result, fail to trigger policy gates, or parse the output incorrectly.

Intent-Code Divergence

Medium
Confidence
94% confidence
Finding
The manifest says suspicious results should map to an exact SUSPICIOUS-style contract and should not lead to installation, but the Output section replaces that with different wording. This creates ambiguity at the precise decision point where an agent may allow or block installation, weakening the safety guarantees of the verifier skill.

Static analysis

No suspicious patterns detected.