Security audit

Skill Vetter

Security checks for vulnerabilities and agentic risk

Overview

This is mostly a security-vetting checklist, but its package and documentation claim a missing PowerShell scanner and install-hook behavior that can block installs and delete downloaded files.

Review this carefully before relying on it as an install gate. The core scanner file claimed by the package is missing, and the documented install-hook behavior should not be enabled unless you can verify exactly what it deletes, logs, and executes.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (14)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The report explicitly states that on scan failure the installer will 'clean up files + block installation' and later describes 'automatic deletion' as a security principle, but it does not clearly warn users that downloaded content will be deleted automatically. Even if intended as safe cleanup, undocumented destructive behavior can cause unexpected data loss or hinder forensic review of what was downloaded and why it was blocked.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The documentation exposes an environment variable that lets users replace the scanner script with an arbitrary local path, but it does not warn that this causes execution of whatever PowerShell script is referenced. In the context of a security-gating tool, this is especially dangerous because an attacker or misconfiguration could silently swap in a malicious or permissive scanner, undermining the entire protection model and potentially executing arbitrary code.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The guide shows use of a bearer token in an API call and explicitly documents a local token storage path, but it does not warn users against exposing, logging, committing, or sharing that credential. In a publishing workflow, users may copy commands into shells, scripts, CI logs, screenshots, or support messages, which can lead to token disclosure and unauthorized skill publication or account actions.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · PUBLISH_GUIDE.md (reported line 88)May include surrounding context.
方法 2: 通过 API

bash
curl -X POST https://api.clawhub.ai/skills \ -H "Authorization: Bearer YOUR_TOKEN" \ -H "Content-Type: application/json" \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · PUBLISH_GUIDE.md (reported line 88)May include surrounding context.
方法 2: 通过 API

bash
curl -X POST https://api.clawhub.ai/skills \ -H "Authorization: Bearer YOUR_TOKEN" \ -H "Content-Type: application/json" \ -d '{

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file is entirely written in Chinese, including headings, usage instructions, risk descriptions, and policy statements, with no indication that other languages are supported or that Chinese is required for a region-specific purpose. This creates a natural-language locale constraint that is not opt-in and may violate organizational language-choice policy.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.
md
• Installs packages without listing them • Network calls to IPs instead of domains • Obfuscated code (compressed, encoded, minified) • Requests elevated/sudo permissions • Accesses browser cookies/sessions • Touches credential files ─────────────────────────────────────────

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.
For GitHub-hosted skills:

bash
# Check repo stats curl -s "https://api.github.com/repos/OWNER/REPO" | jq '{stars: .stargazers_count, forks: .forks_count, updated: .updated_at}' # List skill files curl -s "https://api.github.com/repos/OWNER/REPO/contents/skills/SKILL_NAME" | jq '.[].name'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.
For GitHub-hosted skills:

bash
# Check repo stats curl -s "https://api.github.com/repos/OWNER/REPO" | jq '{stars: .stargazers_count, forks: .forks_count, updated: .updated_at}' # List skill files curl -s "https://api.github.com/repos/OWNER/REPO/contents/skills/SKILL_NAME" | jq '.[].name'

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.
curl -s "https://api.github.com/repos/OWNER/REPO/contents/skills/SKILL_NAME" | jq '.[].name'

Fetch and review SKILL.md

curl -s "https://raw.githubusercontent.com/OWNER/REPO/main/skills/SKILL_NAME/SKILL.md"

text
## Trust Hierarchy (2-Level System)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown includes mandatory labels, headings, and output templates in Chinese such as '官方技能', '其他技能', and the enhanced scan output block entirely in Chinese. That imposes a specific language/locale in the skill's natural-language interface without offering the user a choice or documenting a justified locale-specific requirement.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 198)May include surrounding context.
md
- No skill is worth compromising security - When in doubt, don't install - **High-risk skills are auto-blocked, no confirmation** - **Scan failures result in blocked installation** - Document what you vet for future reference

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file’s natural-language instructions, headings, and explanations are all presented in Chinese, which effectively forces a specific language for users reading the publishing guide. Under the policy, language constraints should either offer user choice or be clearly documented as justified for a region-specific tool, which is not present here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The author field is written only in Chinese characters, which introduces a language-specific metadata element without any accompanying alternative or indication of user choice. Under the policy, language-specific content can be a violation when it imposes a locale or language assumption without opt-in or justification.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

SkillSpector

Missing User Warnings

Missing User Warnings

Missing User Warnings

External Transmission

方法 2: 通过 API

External Transmission

方法 2: 通过 API

Natural-Language Policy Violations

Sudo/Root Execution

External Transmission

External Transmission

Skill Enumeration

Fetch and review SKILL.md

Natural-Language Policy Violations

Autonomous Decision Making

Natural-Language Policy Violations

Natural-Language Policy Violations

Static analysis