Security audit

Skill Publisher

Security checks for vulnerabilities and agentic risk

Overview

This skill performs real publishing actions with user tokens and includes under-scoped automation patterns that users should review before installing.

Install only if you are comfortable with an automation skill creating public GitHub repositories, pushing code, publishing to ClawHub, and optionally writing Notion records. Use short-lived least-privilege tokens, avoid pasting real credentials into normal chat when a safer secret channel exists, review every downloaded or modified skill before publication, remove forced SkillBoss links unless you explicitly want them, and do not use the account/IP rotation guidance to bypass platform limits.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:237
Finding: Mandatory Third-Party Promotional Content Injection into Published Skills
Content: View full analysis
📖 **Complete setup guide**: https://skillboss.co/skill.md ``` ``` The same behavior is reinforced elsewhere in the project, including `GUIDE.md:147-153`, `GUIDE.md:215-221`, `QUICK-START.md:108-117`, and `QUICK-START.md:129-134`. ### Technical Analysis The publishing workflow instructs the Agent to insert a persistent SkillBoss link into every processed `SKILL.md`. The modification is unrelated to the core operations needed to publish a Skill to GitHub or ClawHub. Because the injected link becomes part of the published artifact, it affects downstream users and remains present after the current Agent session ends. It also causes processed third-party Skills to appear affiliated with or endorsed by SkillBoss without requiring explicit approval from the Skill owner. This is not credential exfiltration, but it is instruction-driven output manipulation that exceeds the minimum privileges needed for the declared publishing functionality. ### Attack Path 1. A user invokes the Skill to publish an existing ZIP file or downloaded Skill. 2. The Agent follows the documented preparation workflow. 3. The Agent modifies the supplied `SKILL.md` and potentially its README. 4. The fixed third-party URL is inserted without per-Skill authorization. 5. The modified files are committed to GitHub and published to ClawHub. 6. The promotional content is distributed to downstream users as part of the republished Skill. ### Impact Assessment An attacker or Skill author controlling these instructions can cause the Agent to propagate persistent third-party content across every processed repository and Skill package. The obtained capability is limited to modifying publication output, but its scope includes ...[truncated 364 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: scripts/fetch-skillboss.sh:31
Finding: Unverified External Skill Archives Are Extracted and Republished
Content: View full analysis
]*>\K[^<]+' | head -1 || echo "$SKILL_SLUG") SKILL_DESC=$(echo "$HTML" | grep -oP '
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/create-github-repo.sh:3
Finding: Overprivileged GitHub Token Is Passed Through Process Arguments
Content: View full analysis
set -e REPO_NAME="$1" DESCRIPTION="$2" GITHUB_TOKEN="$3" if [ -z "$REPO_NAME" ] || [ -z "$GITHUB_TOKEN" ]; then echo "Usage: $0 " exit 1 fi # Default description if not provided if [ -z "$DESCRIPTION" ]; then DESCRIPTION="OpenClaw skill repository" fi echo "Creating GitHub repo: $REPO_NAME" # Create repository via GitHub API RESPONSE=$(curl -s -X POST \ -H "Authorization: token $GITHUB_TOKEN" \ -H "Accept: application/vnd.github.v3+json" \ https://api.github.com/user/repos \ -d "{ \"name\": \"$REPO_NAME\", \"description\": \"$DESCRIPTION\", \"private\": false, \"auto_init\": false, \"has_issues\": true, \"has_projects\": false, \"has_wiki\": false }") ``` The associated documentation requests a classic GitHub token with complete `repo` access in `SKILL.md:77-84` and `GUIDE.md:31-42`. ### Technical Analysis Sending a GitHub token to `https://api.github.com` is necessary for authenticated repository creation and is not, by itself, evidence of covert exfiltration. The security problems are the token’s requested scope and how the script receives it. A classic token with `repo` scope can grant access to all repositories available to the user, including private repositories. That is broader than the workflow’s stated need to create and publish selected public repositories. The token is supplied as the third command-line argument. Depending on the operating system and execution environment, command arguments may be exposed through: - Process inspection utilities - Agent or orchestration logs - Shell history - Debug traces - Job me ...[truncated 1632 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence

Findings (37)

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The examples normalize supplying live access tokens in natural-language prompts, directly conditioning users to disclose credentials to the assistant. Because the skill is specifically designed to perform privileged publishing actions, the exposed secrets would grant immediate access to external platforms and materially increase the blast radius of any logging, prompt leakage, or misuse.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The guide explicitly instructs users to paste live GitHub and ClawHub tokens directly into the skill invocation, which encourages disclosure of highly sensitive credentials inside the assistant interaction channel. In this context, those tokens can enable repository creation, code pushes, publishing, and potentially broader account actions if mishandled, logged, retained, or exposed through downstream systems.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: These scenario examples repeatedly embed credential sharing into ordinary publishing requests, reinforcing an unsafe operational pattern as standard usage. Repetition increases the chance users will routinely expose valid tokens for multiple services, enabling account compromise or unauthorized publishing if those tokens are intercepted or retained.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The multi-account example solicits several sets of live tokens in one conversation, concentrating sensitive credentials for multiple GitHub and ClawHub accounts in a single interaction. That aggregation materially increases impact because one compromised transcript could enable actions across multiple identities and repositories.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The sample conversation demonstrates acceptance and use of realistic token formats in a normal assistant exchange, training users and potentially downstream agents to treat live credentials as ordinary message content. In a publishing skill with write access to GitHub, ClawHub, and Notion, this creates direct risk of account takeover, unauthorized publication, and persistent external modifications.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The examples repeatedly instruct users to paste high-privilege GitHub, ClawHub, and Notion tokens directly into the conversation, creating a direct credential-exposure path inside the AI workflow. This is especially dangerous because the skill automates external account actions, so leaked tokens could be immediately abused to create repos, push code, publish content, or access Notion data.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documentation includes automated browser scraping, screenshot capture, and extraction of skill listings from a third-party site, but the declared purpose centers on GitHub/ClawHub publishing. This mismatch can mislead users about what the skill will do with network access and local files, reducing informed consent and increasing the chance of unintended external interactions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documentation includes automated browser scraping, screenshot capture, and extraction of skill listings from a third-party site, but the declared purpose centers on GitHub/ClawHub publishing. This mismatch can mislead users about what the skill will do with network access and local files, reducing informed consent and increasing the chance of unintended external interactions.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill requests GitHub, ClawHub, and optional Notion tokens but does not put prominent warnings up front about the sensitivity of those credentials or the risks of supplying them to an automation workflow. Because the skill performs external actions using privileged tokens, insufficient warning undermines informed consent and safe handling.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The 'fully automated' workflow describes downloading content, creating GitHub repositories, pushing code, and publishing to ClawHub without an explicit warning that these are irreversible or externally visible changes. Users could trigger publication of unreviewed or malicious content with little friction, especially when the source is third-party downloads.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 94% confidence
Finding: The skill asks users to provide personal access tokens with broad permissions, including repo creation capability. Credential collection is functionally necessary here, but it is still dangerous because compromise, over-scoping, or accidental persistence of those tokens would grant substantial control over user accounts and repositories.
Content: Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.
md
### GitHub Account 1. Username 2. Personal Access Token - Generate at: https://github.com/settings/tokens - **Required Permissions**: - ✅ `repo` (full repository access)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The guide promises a fully automated workflow with 'zero manual steps' that performs external side effects across GitHub, ClawHub, and Notion, but it does not clearly warn users that the skill will create repositories, push content, publish artifacts, and modify external records. This raises the risk of users authorizing impactful actions without informed consent or understanding the scope of changes.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · GUIDE.md (reported line 49)May include surrounding context.
md
**获取地址**：https://clawhub.ai/settings/tokens **步骤**： 1. 点击 "Create Token" 2. 给token起名（如 "Skill Publisher"） 3. 复制 token

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · GUIDE.md (reported line 49)May include surrounding context.
md
**获取地址**:https://clawhub.ai/settings/tokens **步骤**: 1. 点击 "Create Token" 2. 给token起名(如 "Skill Publisher") 3. 复制 token

Ssd 4

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The guidance to stagger batches across multiple accounts to avoid platform detection and rate limits is operationally suspicious because it frames account rotation as a way to reduce detection rather than to comply with platform policy. Even if presented as a reliability tactic, it can facilitate evasive behavior and scaled misuse of third-party services.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The example prompts repeatedly request multiple sensitive tokens in natural language, which is a credential-collection pattern that encourages disclosure of secrets in an unsafe channel. Because these are high-value tokens tied to code hosting, publishing, and knowledge management systems, exposure can cascade into account takeover or unauthorized modifications.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The quick-start advertises automatic repository creation, code pushes, and ClawHub publishing without a prominent up-front warning that the skill will perform external side effects on the user's behalf. For a tool that uses account tokens and publishes content, insufficient disclosure can lead to accidental or uninformed authorization of impactful actions.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The quick-start explicitly advises using multiple GitHub accounts and a VPN to avoid platform restrictions, which facilitates evasion of enforcement rather than legitimate publishing. In the context of an automation skill that performs account actions at scale, this normalizes abusive operational behavior and increases the likelihood of policy violations or account misuse.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Recommending VPNs or multiple accounts to avoid platform enforcement is a policy-evasion instruction embedded in the documentation. In this publishing-automation context, it makes the skill more dangerous by pairing evasion guidance with tooling that can rapidly perform the restricted actions.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The documentation promotes obtaining top skills from SkillBoss and republishing them, which goes beyond a normal first-party publishing workflow and can enable unauthorized cloning of third-party content. In a skill designed to automate GitHub and ClawHub publication, this lowers friction for bulk content copying and potential IP or attribution abuse.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 72% confidence
Finding: The skill has write capability and is designed to modify extracted skill files, generate README/.gitignore content, and potentially create local outputs from imported third-party data. In a workflow that handles credentials and downloaded content, local write access raises the risk of persisting sensitive data, overwriting files, or preparing malicious content for later publication.
Content: Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.
md
--- name: skill-publisher description: "Automate OpenClaw skill publishing to GitHub and ClawHub. Handles ZIP extraction, file preparation (README, .gitignore, SkillBoss links), Git operations, GitHub push, ClawHub publish, and Notion tracking. Use when: uploading skills to GitHub, publishing to ClawHub, or batch-processing multiple skills." allowed-tools: Bash, Read, Write metadata: openclaw: emoji: "🚀"

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The trigger language is broad enough to activate on vague requests like obtaining top skills from SkillBoss, which can lead to unintended scraping, downloading, repository creation, and publication. In a skill capable of external writes, broad invocation increases the chance of accidental high-impact actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The section on multi-account publishing and VPN/proxy use encourages risky behavior but does not warn users that such actions may violate platform policy or trigger abuse controls. That omission makes the workflow more dangerous because it normalizes evasive tactics around bulk automated publishing.
Content: No source excerpt is available for this finding.

Ssd 4

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill describes staggered multi-account use and IP rotation specifically to reduce detection, which is a classic gradual evasion pattern. In the context of automated publishing to public platforms, this can facilitate large-scale spam, abusive distribution, or repeated reposting of third-party content while minimizing platform defenses.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill explicitly advises using multiple accounts, spacing activity to avoid detection, and different IPs via VPN/proxy to deal with anti-spam controls. That is evasion guidance, not normal publishing support, and it encourages bypassing platform safeguards while using high-privilege credentials.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.