Security audit

ClawHub Publisher

Security checks for vulnerabilities and agentic risk

Overview

This publishing skill matches its stated purpose, but it asks users to run unreviewed, unpinned external publisher packages that would handle API keys, local skill files, and release changes.

Install only after verifying the official package source and pinning exact versions. Use a scoped, short-lived ClawHub token, prefer dry-run or validation first, inspect local diffs before publishing, and run CI publishing in a minimal workspace with no unrelated secrets.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

Location: README.md:51
Finding: Unpinned and Unverifiable Third-Party Package Execution
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README promotes publishing to ClawHub but does not clearly disclose that skill contents, metadata, and possibly bundled assets are transmitted to an external service. Users may unintentionally upload proprietary code, secrets, or sensitive documentation, especially in automated CI/CD contexts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README advertises automatic README modification via Gumroad link injection but does not clearly warn that local files will be edited. Silent or unexpected file mutation can lead to unintended content changes, accidental commits, or corruption of user documentation in automated workflows.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: The README instructs users to run npx clawhub-publisher without pinning a specific package version, which can cause execution of whatever version is latest at invocation time. That creates a supply-chain risk: a compromised or breaking upstream release could be fetched and executed automatically in CI or on developer machines.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill explicitly advertises one-command publishing, deployment, changelog generation, and asset bundling to an external service, but it does not warn users that invoking it may change release state and transmit skill contents, metadata, and possibly repository-derived information off-host. In a publishing/deployment context this omission is security-relevant because users may run the skill expecting local automation, while it can perform irreversible external actions and disclose packaged artifacts or metadata.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.