ClawHub
Back to skill

Security audit

Selling Skills

Security checks for vulnerabilities and agentic risk

Overview

This skill pack is not clearly malicious, but it bundles broad autonomous, financial, publishing, credential, browser-session, and offensive security capabilities with weak scoping and dependency controls.

Install only after reviewing every referenced dependency and pinning trusted versions. Use isolated workspaces, least-privilege credentials, separate browser profiles, dry-run or paper modes, explicit approval for every trade, post, bid, outreach message, exploit attempt, and vulnerability submission, and avoid placing broad secrets in a shared .env file.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)

T08 · Insecure Dependencies

Error
Location
SKILL.md:732
Finding

Unpinned Third-Party Skills Are Installed and Executed from Mutable Sources

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:732-758; SKILL-hermes-bug-bounty-mastery.skill.md:945-991
Vulnerability Type: Supply-chain compromise through unpinned external Skill dependencies
Risk Level: Critical

Vulnerable Code

SKILL.md:732-758:

bash
# Save this file as skill.md, then execute:
hermes skills install --manifest skill.md

# Or run the inline installer:
hermes skills install clawhub/claw-multi-agent && \
hermes skills install clawhub/masterswarm && \
hermes skills install clawhub/fl-multi-agent-orchestrator && \
hermes skills install clawhub/swarmdock && \
hermes skills install clawhub/swarmskill-coin-trade && \
hermes skills install clawhub/swarmwage-publish && \
hermes skills install clawhub/claw-orchestra && \
hermes skills install clawhub/swarmmarket2 && \
hermes skills install clawhub/agent-swarm-network && \
hermes skills install clawhub/epic-ai-swarm-orchestration && \
hermes skills install clawhub/swarm-layer && \
hermes skills install clawhub/hive-commander && \
hermes skills install clawhub/network-ai && \
hermes skills install clawhub/yuyonghao-agent-swarm && \
hermes skills install clawhub/agent-swarm-workflow && \
hermes skills install clawhub/bountyswarm && \
hermes skills install clawhub/claw-swarm && \
hermes skills install clawhub/clawswarm-jobs && \
hermes skills install clawhub/clawswarm-realtime && \
hermes skills install clawhub/clawhub-memory-tiers-pro && \
hermes skills install clawhub/flow-swarm

SKILL-hermes-bug-bounty-mastery.skill.md:957-991:

bash
# Tier 1: Core AI Engines
hermes skills install browse-sh/bountybook.ai/moneymaxx-qops8y
hermes skills install clawhub/ai-agent-bounty-factory
hermes skills install clawhub/ai-profit-engine
hermes skills i
...[truncated 3415 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin every external Skill to a reviewed immutable version or commit digest.
  2. Verify cryptographic hashes or publisher signatures before installation.
  3. Maintain an explicit allowlist of trusted publishers and repositories.
  4. Vendor security-critical dependencies into a controlled internal registry after review.
  5. Generate and enforce a lockfile containing exact dependency identities and integrity hashes.
  6. Require explicit user approval for each dependency and its requested capabilities.
  7. Execute each Skill in a sandbox with narrowly scoped filesystem, network, secret, browser, and tool permissions.
  8. Prevent dependencies from inheriting all workspace secrets by default.
  9. Continuously monitor pinned upstream dependencies for compromise and revoke affected versions.
  10. Fail closed if signature, checksum, provenance, or immutable-version validation is unavailable.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL-hermes-bug-bounty-mastery.skill.md:998
Finding

Plaintext Workspace Configuration Aggregates High-Value Credentials

Content
View full analysis

Vulnerability Details

File Location: SKILL-hermes-bug-bounty-mastery.skill.md:998-1024
Vulnerability Type: Plaintext sensitive-data exposure and excessive secret sharing
Risk Level: High

Vulnerable Code

bash
### Environment Variables

Create a `.env` file in your Hermes workspace:

```bash
# Bounty Platform API Keys
HACKERONE_API_KEY=your_hackerone_key
BUGCROWD_TOKEN=your_bugcrowd_token
INTIGRITI_API_KEY=your_intigriti_key
IMMUNEFI_API_KEY=your_immunefi_key

# Notification Channels
DISCORD_WEBHOOK_URL=https://discord.com/api/webhooks/...
SLACK_WEBHOOK_URL=https://hooks.slack.com/services/...
SMTP_HOST=smtp.gmail.com
SMTP_USER=your_email@gmail.com
SMTP_PASS=your_app_password

# Agent Configuration
MAX_CONCURRENT_SCANS=8
RATE_LIMIT_RPM=60
STEALTH_MODE=true
PROXY_LIST=/path/to/proxies.txt

# Blockchain (for Rustchain agents)
ETH_RPC_URL=https://mainnet.infura.io/v3/YOUR_PROJECT_ID
SOLANA_RPC_URL=https://api.mainnet-beta.solana.com
text

### Technical Analysis

The guide explicitly directs users to create a `.env` file inside the Hermes workspace and consolidate bounty-platform API keys, bearer tokens, notification webhooks, SMTP credentials, proxy information, and blockchain provider identifiers in that file.

Environment files are commonly readable by other workspace processes and may be unintentionally included in archives, logs, diagnostic bundles, backups, or version control. This is especially dangerous here because the same workspace is intended to execute more than 20 unaudited third-party Skills.

Although a later section recommends Hermes' secret manager and warns users not to commit `.env` files, that guidance conflicts with the concrete configuration procedure. It does not establish filesystem permissions, per-Skill isolation, secret scoping, or technical enforcement.

### Attack Path

1. The user creates the workspace `.env` file as documented.
2. The us
...[truncated 1063 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the recommendation to store secrets in a workspace .env file.
  2. Use Hermes' encrypted secret manager as the only supported credential mechanism.
  3. Expose each Skill only to the specific secrets it requires.
  4. Issue separate, least-privilege credentials for each platform and Skill.
  5. Prefer read-only API keys unless write operations are explicitly required.
  6. Use short-lived credentials and automatic rotation where supported.
  7. Prevent secrets from appearing in logs, diagnostics, prompts, backups, and agent memory.
  8. Add repository rules that reject .env files and scan commits for leaked secrets.
  9. If an environment file is unavoidable, store it outside the shared workspace, enforce mode 0600, and exclude it from synchronization and backups.
  10. Document immediate revocation and incident-response procedures for each credential type.

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL-hermes-bug-bounty-mastery.skill.md:161
Finding

Autonomous Exploitation and Persistent Authenticated Browser Control Exceed Least Privilege

Content
View full analysis

Vulnerability Details

File Location: SKILL-hermes-bug-bounty-mastery.skill.md:91-104, 161-174, 299-313, 832-852
Vulnerability Type: Excessive autonomous offensive and authenticated-session capabilities
Risk Level: High

Vulnerable Code

SKILL-hermes-bug-bounty-mastery.skill.md:91-104:

yaml
- id: cashmachine-bounty-hunter
  source: clawhub/cashmachine-bounty-hunter
  tier: core
  description: >
    Passive income automation engine. Runs 24/7 reconnaissance on
    thousands of targets, queues low-hanging fruit for manual review,
    and maintains a "cash pipeline" dashboard showing estimated
    weekly/monthly/quarterly earnings from queued submissions.
  capabilities:
    - passive-reconnaissance
    - pipeline-management
    - earnings-forecasting
    - submission-queuing
  install_priority: 4

SKILL-hermes-bug-bounty-mastery.skill.md:161-174:

yaml
- id: auto-bounty-hunter
  source: clawhub/auto-bounty-hunter
  tier: specialist
  description: >
    Fully autonomous bounty hunting loop. Given a target scope,
    it performs reconnaissance, vulnerability scanning, exploitation
    attempts, report generation, and submission — all without
    human intervention. Includes safety checks to prevent accidental
    damage or out-of-scope testing.
  capabilities:
    - full-automation
    - scope-enforcement
    - safety-checks
    - end-to-end-pipeline
  install_priority: 8

SKILL-hermes-bug-bounty-mastery.skill.md:299-313:

yaml
- id: arcagent-mcp
  source: clawhub/arcagent-mcp
  tier: communication
  description: >
    Model Context Protocol (MCP) integration for Arc Browser agents.
    Enables seamless browser-based bounty hunting with automated
    form filling, screenshot capture for proof-of-concept, and
    session management across multiple bounty platforms.
  capabilities:
    - browser-automation
    - f
...[truncated 2615 chars]
Remediation
View remediation

Remediation Suggestions

  1. Disable autonomous exploitation and submission by default.
  2. Require explicit human approval before every exploit attempt, write operation, or external submission.
  3. Require machine-verifiable authorization artifacts for every target and program.
  4. Enforce target allowlists outside the installed Skill, at the network proxy or sandbox boundary.
  5. Resolve and validate destinations after redirects and DNS resolution before every request.
  6. Block private, link-local, loopback, metadata-service, and out-of-scope address ranges.
  7. Separate reconnaissance, validation, exploitation, and submission into independently authorized phases.
  8. Use isolated browser profiles with short-lived sessions and no unrelated authenticated accounts.
  9. Store cookies in an encrypted session vault and prevent access by unrelated Skills.
  10. Add immutable audit logs and emergency termination controls.
  11. Default to passive, non-destructive checks with conservative rate limits.
  12. Independently review and test the claimed safety controls before deployment.

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:839
Finding

Master Installer Enables High-Impact Financial, Publishing, Outreach, and Persistent Memory Operations

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:839-850, 903-930
Vulnerability Type: Excessive privilege aggregation across financial and public-action capabilities
Risk Level: High

Vulnerable Code

SKILL.md:839-850:

bash
# Example: Configure the trading skill for live mode (after backtesting)
hermes skills config swarmskill-coin-trade --set trading_mode=live
hermes skills config swarmskill-coin-trade --set risk_per_trade=0.01

# Example: Scale the master swarm controller
hermes skills config masterswarm --set max_agents=100
hermes skills config masterswarm --set heartbeat_interval=15

# Example: Configure memory tiers
hermes skills config clawhub-memory-tiers-pro --set consolidation_schedule="0 */6 * * *"

# Example: Enable all publishing platforms
hermes skills config swarmwage-publish --set platforms=[medium,substack,wordpress,twitter,linkedin]

SKILL.md:903-930:

bash
1. **Content Publishing Pipeline**
   ```bash
   hermes skills config swarmwage-publish --set auto_publish=true
   hermes skills config swarmwage-publish --set content_niche="ai-technology"
   hermes skills start swarmwage-publish
   ```

2. **Bounty Task Automation**
   ```bash
   hermes skills config bountyswarm --set auto_bid=true
   hermes skills config bountyswarm --set task_types=[coding,research,design]
   hermes skills start bountyswarm
   ```

3. **Market Intelligence + Outreach**
   ```bash
   hermes skills config swarmmarket2 --set auto_outreach=true
   hermes skills config swarmmarket2 --set target_industries=[saas,ai,fintech]
   hermes skills start swarmmarket2
   ```

4. **Trading Signal Generation** (paper mode recommended)
   ```bash
   hermes skills config swarmskill-coin-trade --set strategy=momentum
   hermes skills config swarmskill-coin-trade --set alert_only=true
   hermes skills start swarmskill-coin-trade
   ```

Technical Analysis

The m ...[truncated 2181 chars]

Remediation
View remediation

Remediation Suggestions

  1. Split trading, publishing, outreach, bidding, networking, and memory into separate opt-in packages.
  2. Remove live-trading enablement from general quick-start documentation.
  3. Require explicit, transaction-specific approval for every trade, publication, message, and bid.
  4. Implement external spending caps, destination allowlists, rate limits, and approval workflows.
  5. Use read-only or simulation credentials by default.
  6. Prevent one Skill from invoking another Skill's privileged capabilities without policy authorization.
  7. Isolate persistent memory by agent, tenant, and task.
  8. Validate and sanitize data before memory consolidation, and support provenance tracking and rollback.
  9. Disable cross-agent memory sharing and P2P capability advertisement by default.
  10. Maintain tamper-evident audit records for all financial and externally visible actions.
  11. Add emergency shutdown and credential-revocation procedures.
  12. Run high-impact components in separate sandboxes with distinct service accounts and minimal permissions.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The installer explicitly includes monetization features such as advisory ghostwriting and introductions to vulnerability brokers, which extend beyond normal bug bounty workflow support. In a skill pack that also automates discovery and exploitation, these capabilities increase the chance that discovered vulnerabilities or sensitive findings are routed into unvetted external commercialization channels rather than controlled responsible disclosure paths.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The task-acceptance subsystem allows the pack to automatically evaluate and accept incoming bounty invitations, which is not necessary for a mere installer and expands the system's authority over external engagements. In combination with autonomous scanning and submission features, this can silently broaden operational scope and trigger actions against newly accepted targets without meaningful human review.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL-hermes-bug-bounty-mastery.skill.md (reported line 474)May include surrounding context.

md
config_templates:
  bounty_platforms:
    hackerone:
      api_endpoint: "https://api.hackerone.com/v1"
      auth_method: "api_key"
    bugcrowd:
      api_endpoint: "https://api.bugcrowd.com"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The documentation promotes autonomous scanning, exploitation attempts, browser automation, and automated submission without a prominent up-front warning describing the legal, operational, and safety risks. Because this pack is explicitly designed to coordinate many offensive-capable sub-skills, weak warnings materially increase the chance of misuse, accidental out-of-scope activity, or unsafe deployment by inexperienced users.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The configuration section instructs users to place API keys, SMTP credentials, and webhook URLs into environment variables and enables transmission of findings and alerts to third-party services, but it lacks an explicit warning about secret exposure and leakage of vulnerability data. In a system generating sensitive security findings, careless configuration can lead to account compromise or unauthorized disclosure of target information.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

md
- command: "hermes skills list --installed"
    description: "Snapshot currently installed skills before deployment"
    required: false
  - command: "mkdir -p ~/.hermes/skills/clawhub-backups"
    description: "Create backup directory for rollback capability"
    required: false

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The rollback procedure contains a forceful wildcard uninstall command that would remove all ClawHub skills in one step, which is destructive and easy to trigger without adequate warning or confirmation. In a master installer that orchestrates 21 interconnected components, this increases the chance of accidental service disruption, configuration loss, and rollback misuse during troubleshooting.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The quickstart encourages enabling auto_publish, auto_bid, and auto_outreach behaviors for revenue generation without strong, immediate warnings about privacy, consent, account abuse, platform policy violations, or unintended external actions. Because this skill is explicitly designed for autonomous multi-agent automation at scale, these defaults and examples can lead to harmful automated interactions with third-party services and real-world data exposure.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

This master installer file defines concrete templates for Discord, Slack, email SMTP, and multiple bounty-platform API endpoints and auth methods. For a skill whose stated role is installation/orchestration, bundling operational credential integration and outbound notification configuration goes beyond the obvious need to install component skills.

Content

No source excerpt is available for this finding.