Security audit

Skill Publisher — ClawHub 一键发布器

Security checks for vulnerabilities and agentic risk

Overview

The skill is meant to publish ClawHub skills, but it asks the agent to make broad system changes and reuse a publishing token in ways users should review first.

Review before installing. Use it only in a disposable or tightly scoped environment, do not let it patch global CLI files automatically, avoid unpinned global installs, provide ClawHub tokens through a safer secret mechanism, and require explicit confirmation before publishing or scheduling retries.

A.I.G

Vulnerability Patterns

Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T07 · Tool Hijacking and Spoofing

Error

Location: SKILL.md:45
Finding: Global ClawHub CLI Modification Silently Asserts License Acceptance
Content: View full analysis
/dev/null | head -1) # 检查是否已 patch grep -q "acceptLicenseTerms" "$PUBLISH_JS" && echo "已 patch" || \ # 在 payload 构建处加入 acceptLicenseTerms: true sed -i 's/skillName:/acceptLicenseTerms: true, skillName:/' "$PUBLISH_JS" && echo "patch 完成" ``` ### Technical Analysis The skill searches system-wide library directories for a ClawHub `publish.js` file and rewrites the first match in place. The injected property, `acceptLicenseTerms: true`, causes future publish requests to assert acceptance of legal terms without obtaining explicit consent through the supported interface. This violates tool-integrity and least-change principles. The selected file is determined by `find ... | head -1`, so systems with multiple ClawHub installations may have an unintended copy modified. The broad search path also does not verify the package version, file checksum, owner, or exact installation location before applying the substitution. The stated idempotence does not make the operation safe: the first occurrence of `skillName:` may not necessarily be the expected payload field, particularly after package updates. ### Attack Path 1. A user invokes the publishing skill. 2. The agent searches `/usr/local/lib` and `/usr/lib` for a matching `publish.js`. 3. The first matching file is accepted without provenance or integrity verification. 4. `sed -i` rewrites the globally installed module. 5. Subsequent ClawHub publishing operations execute the modified code and automatically send `acceptLicenseTerms: true`. 6. Other users or workflows relying on the same global installation inherit the modified behavior. ### Impact Assessment An invocation may modify shared, globally install ...[truncated 356 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:34
Finding: Unpinned Global Installation of a Third-Party npm Package
Content: View full analysis
Remediation: View remediation
`. - Verify package publisher identity, provenance, registry origin, and integrity hashes. - Require explicit user approval before installing software. - Prefer a project-local installation in a restricted environment rather than `npm install -g`. - Use a lockfile or other immutable dependency manifest. - Disable lifecycle scripts where feasible, or review them before installation. - Resolve and invoke the expected binary through an exact trusted path rather than relying only on `PATH`. - Abort safely if the approved CLI version is not already available. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:42
Finding: Shell Command Injection Through Unquoted User-Controlled Placeholders
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:91
Finding: ClawHub Token May Be Persisted in Scheduled Retry Tasks
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases are broad enough that ordinary discussion about publishing to ClawHub could invoke the skill unintentionally. Because the skill performs installation, file inspection, patching, and network publication, accidental activation could lead to sensitive operations being initiated without sufficiently deliberate user intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill asks for a ClawHub API token and then uses it directly in a shell environment variable for network publication, but provides no explicit privacy or handling warning. This increases the risk of credential exposure through shell history, logs, process listings, or inadvertent reuse, especially in automated agent environments.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill instructs the agent to modify an installed CLI's publish.js in place using sed, which is a destructive system-level code change. Altering software under /usr/local/lib or /usr/lib without explicit warning and consent can break tooling, violate package integrity expectations, and create a supply-chain style persistence point on the host.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill expands its scope from publishing a local package to creating scheduled retry tasks via a separate skill. That cross-skill delegation can create persistent actions the user did not explicitly authorize in the same moment, increasing the risk of unintended repeated publication attempts or token reuse.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The entire skill description and operational instructions are written in Chinese, with no indication that another language can be used or selected. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.