Skill Security Auditor

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:22 AM UTC
• Version: 1.0.1

Overview

This security-auditor skill is not malicious, but it overstates what its simple pattern scan can prove and uses installation/update guidance that deserves careful review.

Install only if you understand this is a lightweight heuristic helper, not a complete security verdict. Prefer pinned installer versions, review the script and pattern database before making it executable, skip the ~/.bashrc alias unless you want that persistent shell shortcut, and do not rely on a 'SAFE' result unless the full skill package and dependencies have also been reviewed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: README.md:38

Finding

Unpinned Package Execution During Installation

Content

View full analysis

Remediation

View remediation

install skill-security-auditor ``` 2. Publish and verify package integrity metadata or cryptographic signatures. 3. Document the expected registry, publisher identity, exact version, and package digest. 4. Prefer installing from an immutable, reviewed artifact rather than executing a mutable registry release directly. 5. Advise users not to invoke the installer with `sudo` or an administrative shell. 6. Add release provenance controls, such as signed tags, reproducible builds, and CI-based package attestations. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: analyze-skill.sh:74

Finding

Scanner Analyzes Only SKILL.md and Can Produce Unsafe False-Negative Recommendations

Content

View full analysis

"$temp_file" 2>/dev/null; then # If JSON parsing fails, the response might be plain text already mv "${temp_file}.json" "$temp_file" 2>/dev/null || true fi ``` The analysis function reads only that single selected file: ```bash # Analyze skill content analyze_skill() { local skill_file="$1" local risk_score=0 local findings_critical=() local findings_high=() local findings_medium=() local findings_social=() local positives=() echo -e "${BLUE}Analyzing skill content...${NC}\n" # Read skill content local content content=$(<"$skill_file") ``` Detection is then limited to regex matching against the single in-memory string: ```bash if echo "$content" | grep -iE "$pattern" &>/dev/null; then risk_score=$((risk_score + score_impact)) findings_critical+=("${id}: ${name} [+${score_impact} points]") findings_critical+=(" └─ ${description}") fi ``` The main routine passes only one file to the analyzer: ```bash # Determine analysis target local analysis_file if [ "$mode" = "file" ]; then if [ ! -f "$target" ]; then echo -e "${RED}Error: File not found: ${target}${NC}" >&2 exit 1 fi analysis_file="$target" echo -e "${BLUE}Analyzing local file: ${target}${NC}\n" else # Fetch from ClawHub analysis_file=$(mktemp) trap "rm -f '$analysis_file'" EXIT if ! fetch_skill "$target" "$analysis_file"; then exit 1 fi echo "" fi # Run analysis analyze_skill "$analysis_file" ``` ### Technical Analysis ...[truncated 2187 chars]

Remediation

View remediation

“No configured signatures were detected in the files analyzed. This is not a complete safety determination.” 7. List every file analyzed and every unsupported analysis area in the report. 8. Fail closed when the complete package cannot be retrieved or parsed. 9. Add tests demonstrating detection when malicious code is placed outside `SKILL.md`. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: analyze-skill.sh:182

Finding

Textual Mentions of Whitelisted Tools and Domains Are Reported as Positive Security Indicators

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (24)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · README.md (reported line 163)May include surrounding context.

l.sh`) that performs pattern-based security analysis of ClawHub skills. The analysis runs locally using the included threat intelligence database.

Installation & Setup

bash

# Install the skill from ClawHub
npx clawhub install skill-security-auditor

# Make the analyzer executable
chmod +x ~/.openclaw/skills/skill-security-auditor/analyze-skill.sh

# Optional: Create alias for convenience
echo 'alias audit-skill="~/.openclaw/skills/skill-security-auditor/analyze-skill.sh"' >> ~/.bashrc
source ~/.bashrc

Audit a Skill Before Installing

Method 1: Analyze by slug (automatic fetch from ClawHub)

bash

~/.openclaw/skills/skill-security-auditor/analyze-skill.sh --slug bitcoin-tracker

# Example output:
# ============================================
#          SECURITY AUDIT REPORT
# ============================================
# 
# Risk Score: 85/100 - ☠️ CRITICAL
# ...

Method 2: Analyze local file

bash

# Download skill first
curl -s "https://clawhub.a

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

l.sh`) that performs pattern-based security analysis of ClawHub skills. The analysis runs locally using the included threat intelligence database.

Installation & Setup

bash

# Install the skill from ClawHub
npx clawhub install skill-security-auditor

# Make the analyzer executable
chmod +x ~/.openclaw/skills/skill-security-auditor/analyze-skill.sh

# Optional: Create alias for convenience
echo 'alias audit-skill="~/.openclaw/skills/skill-security-auditor/analyze-skill.sh"' >> ~/.bashrc
source ~/.bashrc

Audit a Skill Before Installing

Method 1: Analyze by slug (automatic fetch from ClawHub)

bash

~/.openclaw/skills/skill-security-auditor/analyze-skill.sh --slug bitcoin-tracker

# Example output:
# ============================================
#          SECURITY AUDIT REPORT
# ============================================
# 
# Risk Score: 85/100 - ☠️ CRITICAL
# ...

Method 2: Analyze local file

bash

# Download skill first
curl -s "https://clawhub.a

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.md (reported line 188)May include surrounding context.

md

- Wallet private key patterns

4. **Unauthorized Code Execution**
   - `curl | bash` or `wget | sh` patterns
   - Hidden base64 encoded commands
   - Dynamic eval() or exec() on external input

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 179)May include surrounding context.

md

- Wallet private key patterns

4. **Unauthorized Code Execution**
   - `curl | bash` or `wget | sh` patterns
   - Hidden base64 encoded commands
   - Dynamic eval() or exec() on external input

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 179)May include surrounding context.

md

- Wallet private key patterns

4. **Unauthorized Code Execution**
   - `curl | bash` or `wget | sh` patterns
   - Hidden base64 encoded commands
   - Dynamic eval() or exec() on external input

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · patterns/malicious-patterns.json (reported line 86)May include surrounding context.

json

},
      {
        "id": "CLAW-103",
        "name": "Cryptocurrency Wallet Paths",
        "pattern": "\\.bitcoin|\\.ethereum|wallet\\.dat|keystore|metamask",
        "severity": "high",
        "score_impact": 35,
        "description": "Accesses cryptocurrency wallet files or paths"
      },
      {
        "id": "CLAW-104",
        "name": "Browser Credential Storage",
        "pattern": "Cookies|Login Data|Web Data|chrome/Default|firefox/profiles",
        "severity": "high",
        "score_impact": 30,
        "description": "Accesses browser credential storage locations"
      },
      {
        "id": "CLAW-105",
        "name": "Suspicious External Requests",
        "pattern": "fetch|axios|request.*http(s)?://(?!.*github\\.com|.*npm|.*pypi)",
        "severity": "high",
        "score_impact": 20,
        "description": "Makes HTTP requests to non-standard repositories"
      }
    ],
    "medium": [
      {
        "id": "CLAW-201",
        "name": "Environment Variable E

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 52)May include surrounding context.

Manual Installation

bash

# Create skill directory
mkdir -p ~/.openclaw/skills/skill-security-auditor/patterns

# Download SKILL.md

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 56)May include surrounding context.

md

mkdir -p ~/.openclaw/skills/skill-security-auditor/patterns

# Download SKILL.md
curl -o ~/.openclaw/skills/skill-security-auditor/SKILL.md \
  https://raw.githubusercontent.com/YOUR-USERNAME/skill-security-auditor/main/SKILL.md

# Download analyzer script

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 92)May include surrounding context.

md

brew install jq

# Ubuntu/Debian
sudo apt install jq

# Windows (WSL2)
sudo apt install jq

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 95)May include surrounding context.

sudo apt install jq

Windows (WSL2)

sudo apt install jq

text

## Quick Start

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 159)May include surrounding context.

CLAW-102: SSH Key Access [+30 points]

text

### 3. Create Convenience Alias

```bash
# Add to ~/.bashrc or ~/.zshrc

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 162)May include surrounding context.

3. Create Convenience Alias

bash

# Add to ~/.bashrc or ~/.zshrc
echo 'alias audit-skill="~/.openclaw/skills/skill-security-auditor/analyze-skill.sh"' >> ~/.bashrc
source ~/.bashrc

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill requires and documents shell-based execution but does not declare an explicit tool scope such as permissions or allowed-tools. This creates an authorization ambiguity where users or platforms may underestimate the capability of the skill, increasing the chance of unsafe execution in environments that rely on metadata for trust decisions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The 'This tool does NOT' section states that the skill does not automatically scan skills and is only run manually. Later, the 'Continuous Monitoring' section lists auto-audit on updates and periodic re-scanning of installed skills, which directly conflicts with that earlier statement about operational behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documentation markets the analyzer as local-only, but it also instructs users to fetch skills from ClawHub and later update threat intelligence over the network. This mismatch can mislead users about data exposure and trust boundaries, causing them to run the tool in contexts where outbound network access is not expected or allowed.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 83% confidence

Finding

Using npx clawhub without a pinned version allows execution of whichever package version is resolved at install time. If the upstream package is compromised or a breaking/malicious update is published, users may run unreviewed code during installation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The instructions append an alias into ~/.bashrc, creating persistent shell configuration changes on the user's system. Even though the alias itself is not overtly malicious, persistence mechanisms are sensitive because they normalize modifying startup files and could be abused or unexpectedly alter future shell behavior.

Content

Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.

Make the analyzer executable

chmod +x ~/.openclaw/skills/skill-security-auditor/analyze-skill.sh

Optional: Create alias for convenience

echo 'alias audit-skill="~/.openclaw/skills/skill-security-auditor/analyze-skill.sh"' >> ~/.bashrc source ~/.bashrc

text

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This JSON manifest defines a high-impact pattern keyed on generic terms like "prerequisite", "setup", and "installation" combined with download language. In a manifest/config file, that trigger scope is broad enough to overlap with benign everyday software setup instructions, and the file provides no explicit exclusion conditions or negative examples to narrow when the pattern should or should not apply.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · patterns/malicious-patterns.json (reported line 36)May include surrounding context.

json

"pattern": "(curl|wget).*\\|.*(bash|sh|zsh|python)",
        "severity": "critical",
        "score_impact": 40,
        "description": "Dangerous pattern of downloading and executing remote code without verification",
        "mitre_attack": "T1059.004 - Command and Scripting Interpreter: Unix Shell"
      },
      {

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manual installation section instructs users to download multiple files directly from remote URLs and overwrite local paths without warning about trust verification, integrity checking, or repository ownership validation. This increases supply-chain risk because a compromised repo, typo, or substituted URL could place attacker-controlled files into the user's skill directory.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This markdown file includes a command that writes to ~/.bashrc, which affects persistent user shell configuration. While the command is shown as a convenience step, the documentation does not explicitly warn that it modifies a startup file or suggest reviewing the line before appending it.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.