T07 · Tool Hijacking and Spoofing
Error
- Location
SKILL.md:153- Finding
System-Wide ClawHub CLI Modification and Forced License Acceptance
- Content
View full analysis
- Remediation
View remediation
Security audit
GitHub → ClawHub 一键转化发布
Security checks for vulnerabilities and agentic risk
Overview
The skill’s main purpose is understandable, but it asks agents to publish remotely, handle a token in chat, and patch a system-wide CLI file without enough safeguards.
Review before installing. Use only with an explicit GitHub-to-ClawHub publishing request, do not paste long-lived or broad-scope tokens into chat, require a final confirmation before publishing, and do not allow it to patch /usr/local/lib or auto-accept license terms. Prefer a dedicated workspace, a least-privileged temporary token, and an official CLI update instead of the documented patch workaround.
Vulnerability Patterns
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:23- Finding
Unsafe Collection and Shell Handling of a ClawHub Publishing Token
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger description uses broad phrases like '类似需求时触发' and several generic variants, which can cause the skill to activate for loosely related requests. Because this skill performs web fetching, local file creation, shell execution, and remote publication, accidental activation can escalate into unintended side effects rather than a harmless misfire.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill instructs the user to provide a ClawHub token and requires shell execution, but it does not include safeguards for secret handling or warnings about filesystem and system changes. In context, the workflow writes under /root, executes shell commands, and publishes remotely, so omission of credential and execution safety guidance creates a meaningful risk of token exposure and unintended local modification.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Quick mode allows the skill to go from a single user message directly to fetching content, generating artifacts, modifying the local filesystem, and publishing to a remote registry without an explicit final confirmation. Since publication is an external, state-changing action and the skill may also patch CLI files in error handling, skipping a confirmation step materially increases the chance of accidental or socially engineered releases.
- Content