ClawHub Publish Doctor

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 7:55 PM UTC
• Version: 1.0.0

Overview

This skill is a straightforward ClawHub publishing helper with some security hygiene issues users should notice before following its commands.

Before installing or using this skill, verify the ClawHub CLI package and avoid running npm install commands with elevated privileges. Treat login tokens as secrets, and consider fixing the scripts to use secure temporary files or shell variables before using them on shared systems.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/clawhub_preflight.sh:7
• Finding: Unpinned Global npm Package Installation<![CDATA[ ## Vulnerability Details **File Location**: `scripts/clawhub_preflight.sh:7-11`; `references/error-map.md:46-49` **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash if command -v clawhub >/dev/null 2>&1; then ok "clawhub found: $(clawhub --cli-version 2>/dev/null || echo 'unknown version')" else warn "clawhub not found. Install: npm i -g clawhub" fi ``` The error map additionally recommends forced installation: ```markdown **Fix:** - Standardize on `clawhub`. - If needed, reinstall: `npm i -g clawhub --force` ``` ### Technical Analysis The installation instructions resolve the mutable latest version of the `clawhub` npm package without pinning a reviewed version or verifying package integrity or provenance. npm packages may execute lifecycle scripts during installation, so installing a compromised or unexpectedly changed release can execute code with the privileges of the user running npm. The `--force` recommendation further weakens installation safeguards and may overwrite an existing global package installation. The project does not itself perform the installation automatically, so exploitation requires a user to follow the displayed or documented command. ### Attack Path 1. An attacker compromises the npm package, a package maintainer account, or the package publishing process. 2. The attacker publishes a malicious release under the package name used by the instructions. 3. A user follows `npm i -g clawhub` or `npm i -g clawhub --force`. 4. npm retrieves the mutable latest release and may execute its lifecycle scripts. 5. The malicious package executes with the installing user's privileges and persists as a globally available command. ### Impact Assessment Successful exploitation can provide arbitrary code execution under the installing user's account. A global installation can also replace the trusted `clawhub` executable and affect subsequent publishing and authe ...[truncated 309 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin the installation command to a reviewed release, for example `npm install --global clawhub@<reviewed-version>`. - Document the package's official registry location, publisher, and source repository. - Verify npm provenance, release signatures, or expected integrity metadata before installation. - Avoid recommending `--force` as a standard recovery action. Require users to investigate package conflicts before replacing an existing global installation. - Prefer a lockfile-controlled or isolated installation mechanism where practical. - Establish a process for reviewing and updating the pinned version when security fixes are released. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/clawhub_preflight.sh:28
• Finding: Predictable Temporary Files Allow Symlink-Based File Truncation<![CDATA[ ## Vulnerability Details **File Location**: `scripts/clawhub_preflight.sh:28-32`; `scripts/clawhub_publish_safe.sh:35-39` **Vulnerability Type**: Unsafe predictable temporary files **Risk Level**: Medium ### Vulnerable Code From `scripts/clawhub_preflight.sh`: ```bash if command -v clawhub >/dev/null 2>&1; then if clawhub whoami >/tmp/clawhub_whoami.txt 2>/tmp/clawhub_whoami.err; then ok "authenticated: $(cat /tmp/clawhub_whoami.txt | tail -n 1)" else warn "not authenticated. Run: clawhub login --token <clh_token>" fi fi ``` From `scripts/clawhub_publish_safe.sh`: ```bash if ! clawhub whoami >/tmp/clawhub_publish_whoami.out 2>/tmp/clawhub_publish_whoami.err; then echo "ERROR: Not logged in. Run: clawhub login --token <clh_token>" >&2 exit 4 fi ``` ### Technical Analysis Both scripts write to fixed, predictable paths under the shared `/tmp` directory. Shell output redirection opens these paths with truncation before executing `clawhub whoami`, and the scripts neither create the files securely nor verify that they are regular files owned by the current user. On a system where symbolic-link protections are absent, disabled, or bypassable, another local user can pre-create one of these paths as a symbolic link to a file writable by the victim. When the victim runs the script, the redirection follows the link and truncates the target. The files are also not deleted after use. Authentication identity output and CLI error details can consequently remain in temporary storage longer than necessary. Modern operating-system protections for sticky temporary directories may reduce the symlink attack in some environments, but the scripts should not depend on those environment-specific controls. ### Attack Path 1. A local attacker predicts one of the fixed names, such as `/tmp/clawhub_whoami.txt`. 2. The attacker creates that path as a symbolic link to a target file that the future script user can modify. 3. The victim runs the affected ...[truncated 1064 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Create a private temporary directory with `mktemp -d` rather than using fixed paths. - Register a cleanup trap immediately after creation: ```bash TMP_DIR="$(mktemp -d)" chmod 700 "$TMP_DIR" trap 'rm -rf -- "$TMP_DIR"' EXIT HUP INT TERM ``` - Store output only inside that directory: ```bash WHOAMI_OUT="$TMP_DIR/whoami.out" WHOAMI_ERR="$TMP_DIR/whoami.err" if clawhub whoami >"$WHOAMI_OUT" 2>"$WHOAMI_ERR"; then ok "authenticated: $(tail -n 1 -- "$WHOAMI_OUT")" else warn "not authenticated. Run: clawhub login --token <clh_token>" fi ``` - Avoid temporary files entirely where output can be captured safely in a shell variable. - Apply a restrictive `umask`, such as `umask 077`, before creating files that may contain account or diagnostic information. - Do not run these scripts with elevated privileges unless publishing genuinely requires those privileges. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: The markdown instructs users to authenticate with `clawhub login --token <clh_token>`, which involves sensitive credentials. The file does not include any warning to avoid exposing tokens in shell history, logs, or shared terminals, even though this behavior could affect user privacy and account security.

Static analysis

No suspicious patterns detected.