project-deep-analyzer

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:46 PM UTC
• Version: 1.0.0

Overview

The skill itself is a non-executable project-analysis checklist, but its README directs users to an unverified external ClawHub registration URL.

Use the skill content only as a project-analysis checklist. Before following the README publishing instructions, independently verify the official ClawHub registration endpoint and avoid granting repository or account permissions through the linked domain unless its ownership and requested permissions are clear.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:23
• Finding: Unverified Third-Party Domain Presented as a ClawHub Registration Endpoint## Vulnerability Details **File Location**: `README.md`, line 23 **Vulnerability Type**: Untrusted external service and supply-chain endpoint **Risk Level**: Medium **Vulnerable Code Snippet**: ```markdown 3. **Register on ClawHub**: Visit [ClawHub](https://onlycrabs.ai/skills) (or the official ClawHub entry point) and submit your repository URL. ``` ### Technical Analysis The documentation identifies `github.com/openclaw/clawhub` as the ClawHub project but directs users to `onlycrabs.ai` for registration. The project contains no evidence establishing that this unrelated domain is owned, operated, or officially endorsed by ClawHub. Presenting an unverified third-party domain under the trusted “ClawHub” label creates a supply-chain trust-boundary issue. Users may reasonably assume that the linked service is an official registry and provide repository metadata or follow authentication and publication instructions supplied by that service. The audited repository does not retrieve or execute content from this URL automatically; exploitation requires a user to follow the documentation. ### Attack Path 1. A user follows the publication instructions in `README.md`. 2. The user clicks the link labeled “ClawHub” and is taken to `https://onlycrabs.ai/skills`. 3. Believing the endpoint to be official, the user submits a repository URL or follows registration or authentication prompts. 4. If the endpoint is unauthorized or compromised, its operator can collect submitted metadata, redirect the user, or present deceptive authorization instructions. 5. Any further impact depends on what information or permissions the user voluntarily provides; the repository itself does not contain an automated credential-transfer or code-execution mechanism. ### Impact Assessment The directly exposed scope is information intentionally submitted to the external service, including repository URLs and related publication metadata. If a user additional ...[truncated 441 chars]
• Remediation: ## Remediation Suggestions 1. Replace `https://onlycrabs.ai/skills` with a registry URL verified through official ClawHub or OpenClaw documentation. 2. Use the canonical official domain directly rather than an unrelated domain or redirect. 3. Document how users can independently verify the registry endpoint before submitting repository information. 4. Avoid instructing users to enter credentials, access tokens, or grant repository permissions through endpoints whose ownership has not been established. 5. If the third-party service is intentionally supported, clearly identify it as a third-party provider, document its operator and required permissions, and link to its security and privacy policies. 6. Add a warning advising users to verify the destination domain and requested permissions before completing authentication or repository authorization.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The invocation guidance is broad enough to match many ordinary requests for project understanding or troubleshooting, which can cause the skill to be invoked more often than intended. Over-broad triggering increases prompt-surface exposure to untrusted repository content and may cause the agent to perform expansive analysis in contexts where a narrower, safer tool would be more appropriate.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The description says to invoke the skill whenever the user needs to deeply understand a codebase or troubleshoot difficult problems, which is a very broad natural-language condition. It does not define specific trigger phrases, scope limits, or exclusion conditions, so it could overlap with many ordinary coding-assistance requests and cause unintended invocation.

Static analysis

No suspicious patterns detected.