GitHub → ClawHub 一键转化发布

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:44 PM UTC
• Version: 1.1.0

Overview

The skill’s main purpose is understandable, but it asks agents to publish remotely, handle a token in chat, and patch a system-wide CLI file without enough safeguards.

Review before installing. Use only with an explicit GitHub-to-ClawHub publishing request, do not paste long-lived or broad-scope tokens into chat, require a final confirmation before publishing, and do not allow it to patch /usr/local/lib or auto-accept license terms. Prefer a dedicated workspace, a least-privileged temporary token, and an official CLI update instead of the documented patch workaround.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T07 · Tool Hijacking and Spoofing

Error

• Location: SKILL.md:153
• Finding: System-Wide ClawHub CLI Modification and Forced License Acceptance<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 153-159 **Vulnerability Type**: `T07: Tool Hijacking and Spoofing` **Risk Level**: High ### Vulnerable Code ```bash PUBLISH_JS=$(find /usr/local/lib -name "publish.js" -path "*/clawhub/*" | head -1) grep -q "acceptLicenseTerms" "$PUBLISH_JS" || \ sed -i 's/skillName:/acceptLicenseTerms: true, skillName:/' "$PUBLISH_JS" ``` ### Technical Analysis The Skill instructs the agent to locate and directly modify a JavaScript file belonging to a system-wide ClawHub CLI installation. This changes the behavior of a trusted local tool instead of limiting changes to the generated Skill package. The target is selected using `find` followed by `head -1`, without verifying the package version, installation path, file integrity, or expected source structure. If multiple matching installations or unrelated matching files exist, the command may modify the wrong file. The `sed` replacement is also structure-unaware and may corrupt the CLI or inject the property at an unintended location. Adding `acceptLicenseTerms: true` automatically bypasses an explicit license-acceptance failure. This makes a legal and security-relevant decision without obtaining explicit user consent. The modification persists after the current Skill run and affects later ClawHub operations performed by other sessions or users of the same installation. Altering a global tool is not required for the declared GitHub-to-ClawHub conversion workflow and exceeds minimum privilege. ### Attack Path 1. A publication attempt returns a `400` error associated with `acceptLicenseTerms`. 2. The agent follows the documented remediation procedure. 3. The agent searches `/usr/local/lib` and selects the first matching `publish.js`. 4. If the agent has sufficient filesystem privileges, `sed -i` permanently modifies that file. 5. Subsequent ClawHub CLI calls execute the modified implementation and automatically assert acceptance of license terms. 6 ...[truncated 956 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the global CLI patching procedure from the Skill. - Do not modify files under `/usr/local/lib` or any other system-wide package directory. - Do not automatically assert acceptance of legal terms. Require the user to review and explicitly accept them through the official interface. - Resolve the compatibility problem by upgrading to an official fixed release of the ClawHub CLI. - If no fixed release is available, stop publication and report the incompatibility instead of editing installed dependencies. - Pin and verify the supported CLI version before publication. - Run the Skill with a dedicated, unprivileged account that cannot write to system package directories. - If any local workaround is unavoidable, use a user-approved, isolated copy of the CLI with integrity checks and a documented rollback procedure. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:23
• Finding: Unsafe Collection and Shell Handling of a ClawHub Publishing Token<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 23-26, 136-143, and 177-181 **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: Medium ### Vulnerable Code The Skill requires the user to provide a ClawHub token and then inserts it into a shell command: ```bash CLAWHUB_TOKEN={token} \ clawhub publish {SKILL_DIR} \ --slug {slug} \ --name "{displayName}" \ --version 1.0.0 \ --changelog "Initial release: {description}" \ --tags "{tags}" ``` The documented fast path also directs the workflow to proceed immediately when a token is included in the user's message. ### Technical Analysis The workflow explicitly solicits an API token through the conversational channel. Secrets entered into chat may be retained in conversation history, agent traces, debugging output, telemetry, or tool-call records. The instructions do not require redaction, prevent the token from being echoed, define retention controls, or direct the user to a protected secret-management mechanism. The token placeholder is interpolated into shell syntax without quoting or a specified validation step. If the implementation performs direct textual substitution, shell metacharacters in the substituted value could change command parsing. Although legitimate ClawHub tokens are expected to use a constrained format, the Skill does not require enforcement of that format before command construction. Other user-controlled values, including the slug, display name, changelog description, and tags, are also inserted into a shell command template. Quoting some fields reduces ordinary parsing errors but does not establish safe execution when values are assembled into a shell command string. Network transmission of the token to ClawHub is necessary to authenticate the declared publication operation. The security issue is not the legitimate authenticated request itself; it is collecting the token in chat and handling it through an unsafe shell template ...[truncated 1952 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Do not ask users to paste API tokens into chat. - Require the token to be configured through a protected secret store, credential manager, or environment injection mechanism outside the conversational transcript. - Use a dedicated, revocable, least-privileged token limited to the publication operations required by the Skill. - Never print, echo, summarize, or include the token in responses, logs, error reports, or command traces. - Validate the token against a strict allowlist format before use and reject unexpected characters. - Invoke the ClawHub executable through a structured process API with a fixed executable and separate argument array; do not construct a shell command string. - Validate and safely pass every user-controlled parameter, including slug, display name, tags, paths, and changelog text. - Disable shell expansion where possible and avoid `eval`, command concatenation, and indirect shell execution. - Redact environment variables and authorization values from diagnostic output. - Clear temporary secret material after publication and document token revocation procedures. - Require explicit user confirmation immediately before the authenticated publication action. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger description uses broad phrases like '类似需求时触发' and several generic variants, which can cause the skill to activate for loosely related requests. Because this skill performs web fetching, local file creation, shell execution, and remote publication, accidental activation can escalate into unintended side effects rather than a harmless misfire.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill instructs the user to provide a ClawHub token and requires shell execution, but it does not include safeguards for secret handling or warnings about filesystem and system changes. In context, the workflow writes under /root, executes shell commands, and publishes remotely, so omission of credential and execution safety guidance creates a meaningful risk of token exposure and unintended local modification.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Quick mode allows the skill to go from a single user message directly to fetching content, generating artifacts, modifying the local filesystem, and publishing to a remote registry without an explicit final confirmation. Since publication is an external, state-changing action and the skill may also patch CLI files in error handling, skipping a confirmation step materially increases the chance of accidental or socially engineered releases.

Static analysis

No suspicious patterns detected.