My Skill ClawHub Skill

• Outcome: Pass
• Latest audit: Sep 14, 2026 · 10:58 PM UTC
• Version: 1.0.0

Overview

This skill is a straightforward ClawHub publish/install wrapper, with a real but disclosed supply-chain caution around installing the latest remote skill by slug.

Before using the install command, prefer specifying an exact version and confirm the slug and publisher in ClawHub. Treat the search step as discovery, not a security verification, because this helper does not independently verify signatures or digests.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/clawhub_helper.sh:26

Finding

Unpinned Remote Skill Installation Without Integrity or Trust Validation

Content

View full analysis

Vulnerability Details

File Location: scripts/clawhub_helper.sh, lines 26-38
Vulnerability Type: Supply-chain exposure through unverified remote Skill installation
Risk Level: Medium

bash

      echo "Searching for $SLUG..."
      clawhub search "$SLUG"
      
      if [ -z "$VERSION" ]; then
          echo "Installing latest version of $SLUG..."
          clawhub install "$SLUG"
      else
          echo "Installing $SLUG version $VERSION..."
          clawhub install "$SLUG" --version "$VERSION"
      fi

Technical Analysis

The installation workflow permits a remote Skill to be installed without an explicit version. In this case, clawhub install "$SLUG" resolves whichever release is considered latest at execution time. The script does not verify an expected digest, cryptographic signature, publisher identity, trusted registry source, or approved package allowlist.

The preceding clawhub search "$SLUG" operation is informational rather than a security control. Its output is not parsed or validated, and the script does not terminate if the search command fails because no explicit status check or fail-fast shell option is present. Providing a version reduces unintended upgrades but still does not authenticate the downloaded content or establish its integrity.

Consequently, the installed artifact can differ from the artifact previously reviewed by the user. This creates a supply-chain trust gap if the registry, publisher account, package namespace, or selected release is compromised.

Attack Path

1. An attacker compromises the publisher account or registry entry associated with a requested slug, takes over an abandoned namespace, or publishes a malicious latest release under a deceptively trusted slug.
2. A user invokes clawhub_helper.sh install <slug> without supplying a version.
3. The wrapper performs a search but does not validate the result or stop on search failure.

...[truncated 1051 chars]

Remediation

View remediation

Remediation Suggestions

1. Require callers to provide an explicit, immutable version rather than installing the latest release by default.
2. Resolve the selected release to a cryptographic digest and verify that digest before installation.
3. Require valid package signatures from approved publisher identities and reject unsigned or incorrectly signed artifacts.
4. Restrict installation to explicitly trusted registries and, where practical, maintain an allowlist of approved Skill slugs and publishers.
5. Validate search or metadata results before installation, including the canonical slug, publisher, version, and expected source.
6. Abort immediately when discovery or verification fails. Enable fail-fast behavior or explicitly check each command's exit status.
7. Install newly retrieved Skills into a quarantine or staging location, inspect their instructions and scripts, and only promote them after policy checks pass.
8. Record the resolved version, digest, publisher identity, and registry source in an auditable lock file so later installations reproduce the reviewed artifact.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.