ClawHub Publish Doctor

• Analyzed: May 12, 2026, 4:09 AM
• Findings: 1
• Version: 1.0.0
• Hash: 24b36e77efdce5947f1c75e16084b0af964a878ed64a3a20bde5956de02d4ebf
• Source: palm
• External report: View on VirusTotal

Findings (1)

The `scripts/clawhub_publish_safe.sh` file directly passes unsanitized user-controlled arguments (skill path, slug, name, version, changelog) to the `clawhub publish` command. This creates a potential command injection vulnerability if the `clawhub` CLI or the underlying environment is susceptible to shell injection via its arguments (e.g., if it internally uses `eval` or `system()` without proper escaping). While the script's stated purpose is benign (to publish skills), this lack of input sanitization represents a significant security risk, allowing for potential arbitrary command execution if exploited. There is no evidence of intentional malicious behavior such as data exfiltration or persistence.