ClawHub
Back to skill

Security audit

Temp Publish

Security checks for vulnerabilities and agentic risk

Overview

This skill is openly designed to install and run other skills on demand, but its reflex and third-party-source rules leave too much high-impact execution to weak or opt-out approval.

Review this carefully before installing. It is not evidence of malware, but it delegates future work to newly installed skills and can learn to run read-only skills through a reflex path with weak opt-out wording. Use it only if you are comfortable approving third-party skill acquisition, and prefer settings or edits that require explicit approval, verified sources, and full package inspection before every install and execution.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Error
Location
SKILL.md:29
Finding

Unreviewed Third-Party Skills Can Be Installed and Executed

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:29-31, with the resulting installation and execution flow at SKILL.md:61-76
Vulnerability Type: Third-party supply-chain compromise
Risk Level: High

Vulnerable Instructions:

text
3. On miss, search ClawHub: `clawhub search "<3-5 English keywords>"`. Read summaries only, pick up to **3** candidates. If fewer than 2 relevant results, supplement with a GitHub search (mark as unreviewed source).

The selected dependency is subsequently installed and followed:

text
### 3.1 Install

```bash
clawhub install <slug>

3.2 Execution Plan

Read the installed Skill's SKILL.md and present to the user:

  • Step summary
  • Side-effect severity: 🟢 read-only 🟡 write 🔴 destructive 🔑 sensitive credentials ⚙️ shell commands
  • Relevant prefrontal lessons (if any) — e.g., proactively check for a dependency known to be commonly missing

Reflex mode skips this step. Standard mode waits for user confirmation.

3.3 Execute

Follow the Skill's instructions to complete the task.

text

### Technical Analysis

The candidate-selection process explicitly relies on summaries and permits Skills from GitHub that are marked as unreviewed. The workflow does not require verification of a package signature, publisher identity, immutable digest, provenance record, or complete package contents before installation.

User approval based on a description, star count, download count, or scan status does not establish that the installed artifact is trustworthy. Moreover, reading only the search summary cannot reveal malicious instructions, bundled scripts, undeclared network behavior, or credential access contained in the package.

After installation, the agent is instructed to follow the third-party Skill's `SKILL.md`. This turns the selected package into an instruction and execution channel operating with the permissions available to the agent and
...[truncated 1813 chars]
Remediation
View remediation

Remediation Suggestions

  1. Restrict installation to trusted registries and an explicit allowlist of verified publishers. Do not install candidates from arbitrary GitHub repositories.
  2. Require cryptographic signature and publisher-identity verification before installation.
  3. Pin each approved Skill to an immutable content digest, not only a mutable slug or version string.
  4. Download packages into a non-executable staging area and inspect the complete package, including SKILL.md, scripts, manifests, symbolic links, and dependency declarations, before installation.
  5. Reject unreviewed candidates by default. Any exceptional use should require a separate high-risk authorization that clearly identifies the untrusted source.
  6. Display package provenance, verified digest, requested permissions, network destinations, executable files, and changes from any previously approved version.
  7. Execute third-party Skills in a sandbox with a read-only filesystem by default, a minimal environment, no ambient credentials, an outbound network allowlist, and narrowly scoped tool permissions.
  8. Require separate affirmative authorization before granting file writes, credential access, shell execution, or network access.
  9. Treat popularity metrics and malware-scan status as supplemental signals only, never as substitutes for provenance and content verification.

T08 · Insecure Dependencies

Error
Location
SKILL.md:38
Finding

Reflex Mode Allows Installation and Execution Without Affirmative Approval

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:38-46; conflicting boundary rule at SKILL.md:144-146
Vulnerability Type: Authorization bypass in the reflex execution flow
Risk Level: High

Vulnerable Instructions:

text
### Reflex Fast Path

The top candidate may enter reflex mode when ALL of the following hold:
- `reflex: true` AND effective_weight >= 0.90 AND consecutive successes >= 5
- **No write side effects** (side_effects contains no `write:`/`delete:`/`shell:` prefix)
- **Version unchanged** (slug + version match the stored record)

Reflex mode **skips only the execution plan confirmation**. Installation still requires user notification:

⚡ Skill Cortex reflex: todoist-cli v1.2.0 (96% success rate) Task: query today's todos (read-only) | Will install and execute. Say cancel to abort.

text

This opt-out behavior conflicts with the later boundary rule:

text
2. Installation requires user confirmation (including reflex mode).

Technical Analysis

The reflex notification states that the Skill will be installed and executed unless the user cancels. This is an opt-out mechanism, not explicit approval. It therefore contradicts the stated rule that installation requires user confirmation.

The reflex trust decision also identifies unchanged content only through a matching slug and version. These metadata fields are not cryptographic integrity controls. A compromised registry, publisher account, or mutable release could serve different content under the same slug and version without triggering automatic demotion.

Although reflex eligibility excludes side effects declared with write:, delete:, or shell: prefixes, those tags are stored metadata rather than demonstrated enforcement. The audited design does not require an independent permission analysis or runtime sandbox to ensure that the installed Skill's actual behavior matches its recorded tags.

Attac

...[truncated 1574 chars]

Remediation
View remediation

Remediation Suggestions

  1. Require a clear affirmative response before every Skill installation, including reflex mode. Silence or failure to cancel must never count as consent.
  2. Separate installation approval from execution approval. The system should wait for both decisions when newly downloaded content will run.
  3. Change the notification to an approval prompt such as: “Approve installation and read-only execution of this verified artifact? Reply approve to continue.”
  4. Bind reflex trust to an immutable cryptographic digest and verified publisher identity in addition to slug and version.
  5. Automatically demote reflex status whenever the package digest, signature, publisher identity, requested permissions, dependency graph, or complete Skill contents change.
  6. Recompute side effects from the current downloaded artifact before every execution instead of trusting historical tags.
  7. Enforce declared read-only behavior at runtime through sandboxing and capability restrictions. Do not rely solely on textual side_effects prefixes.
  8. Prevent reflex execution from receiving shell access, filesystem write access, ambient credentials, or unrestricted network access.
  9. Resolve the contradictory instructions in SKILL.md so the fast path and boundary rules both unambiguously require explicit approval.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Vague Triggers

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The trigger condition is broad enough to activate whenever the system believes existing skills are insufficient, which can cause this skill to initiate package discovery and installation in situations the user did not clearly request. In this skill’s context, over-triggering is especially dangerous because activation can lead to searching external registries and preparing execution of newly acquired skills, expanding the attack surface and increasing the chance of unsafe or unintended tool use.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 50)May include surrounding context.

md
- **Entity filtering**: signal words are stripped of personal data before storage
- **Synaptic pruning**: stale routes and low-confidence lessons are automatically cleaned up
- **Failure recovery**: auto-retry, candidate switching, and structured error reporting
- **Safety-first**: write operations never enter reflex; all installs require user consent

## Installation

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The instruction to semantically match using the model’s own judgment creates an open-ended routing decision that can misclassify unrelated tasks and invoke this skill without reliable boundaries. In a skill that can search ClawHub/GitHub and install capabilities, ambiguous intent matching increases the likelihood of unauthorized or unnecessary acquisition of third-party code.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The instruction hard-codes ClawHub search to use '3-5 English keywords,' which imposes a specific language choice regardless of the user's language or locale. The file does not offer opt-in, fallback behavior, or a documented reason for this language restriction.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.