Security audit

skill-publisher

Security checks across malware telemetry and agentic risk

Overview

This is a coherent publishing helper, but it can make public account changes and tells the agent to patch a local CLI file, so it needs review before installation.

Install only if you intend to let an agent publish skills using your GitHub and ClawdHub sessions. Require a dry run and explicit confirmation before repo creation, pushes, ClawdHub publish, skills.sh issue creation, uninstall, or deletion steps. Do not allow automatic patching of files under ~/.npm/_npx; use a fixed or updated ClawdHub CLI instead.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill explicitly instructs the agent/user to modify code inside a locally installed third-party CLI under the user's environment. That goes beyond normal publishing actions and creates supply-chain and integrity risk: it can normalize editing executable tooling in opaque cache paths, make future behavior unpredictable, and provide a foothold for unsafe code changes if the instructions are altered or misapplied.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The usage examples include very generic trigger phrases such as "publish my skill" and multilingual variants that could plausibly appear in ordinary conversation. If an agent auto-invokes skills from natural language, these broad phrases can cause unintended activation of a workflow that performs external side effects such as repository creation, publishing, and issue submission.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The trigger phrases shown are broad natural-language requests such as 'publish my skill' and equivalent Chinese variants, which can plausibly appear in ordinary conversation and may unintentionally activate a high-impact publishing workflow. In this skill's context, accidental activation is more dangerous because the documented workflow performs repository creation, publishing, and submission actions across multiple external services.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The README states that the skill will create repositories, push code, publish to ClawdHub, and open an indexing issue, but it does not prominently warn that these are write operations against remote services. This is risky because users may invoke the skill expecting assistance or validation, while the skill may instead make irreversible or externally visible changes using authenticated CLI sessions.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The skill includes destructive cleanup commands without an explicit confirmation step or guardrails. Even though the target path appears test-related, deletion commands in agent workflows are risky because path variables, substitutions, or operator error can turn a cleanup step into data loss.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.