T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:418
- Finding
- Manual publishing fallback can upload sensitive local files## Vulnerability Details **File Location**: `SKILL.md:418-421` **Vulnerability Type**: Excessive sensitive-file access and unrestricted network upload **Risk Level**: High **Relevant snippet (English rendering of the source instructions):** ```text 2. Read the token from the local ClawHub configuration: - Verified macOS path: ~/Library/Application Support/clawhub/config.json 3. Manually send a multipart/form-data request to: https://clawhub.ai/api/v1/skills - Include slug, displayName, version, changelog, tags, and acceptLicenseTerms: true in the payload. - Upload each text file in the Skill directory as files. ``` ### Technical Analysis Using an authentication token and transmitting Skill files to ClawHub are consistent with the declared publishing function. However, the fallback instructs the agent to read a credential from a local configuration file and upload every text file in the Skill directory. This file-selection policy is broader than the minimum privilege required to publish a Skill. A project directory can contain `.env` files, credentials, private notes, exported data, development configuration, or other unrelated text files. The instructions do not define: - An explicit upload allowlist - Exclusion of dotfiles and credential files - A file-size limit - A secret scan - A preview of the files selected for upload - Explicit user confirmation before transmission - A mechanism that prevents the agent from observing or exposing the raw token Consequently, the legitimate publishing operation can become an unintended data-exfiltration channel even though the stated destination is the declared ClawHub service. ### Attack Path 1. A sensitive text file, such as `.env`, a private note, or a configuration export, exists in the Skill directory. 2. The normal `clawhub publish` operation encounters the documented compatibility error. 3. The agent follows the manual fallback instructio ...[truncated 919 chars]
- Remediation
- ## Remediation Suggestions 1. Prefer the official authenticated ClawHub CLI and avoid manual token handling whenever possible. 2. If a manual API fallback remains necessary, obtain authentication through a credential helper that does not reveal the raw token to the agent or logs. 3. Replace broad text-file enumeration with an explicit allowlist, for example: - `SKILL.md` - `README.md` - `package.json` - `CHANGELOG.md` - Specifically approved files under `references/` and `scripts/` 4. Reject dotfiles, symbolic links, files outside the canonical project root, credential files, private keys, and files that exceed a documented size limit. 5. Run a secret scanner before upload and fail closed when likely credentials are detected. 6. Display the final file manifest, destination hostname, and total upload size, then require explicit user approval. 7. Ensure request diagnostics redact authorization headers, tokens, cookies, and multipart content. 8. Document the precise data transmitted and the applicable ClawHub visibility and retention behavior.