my_skill_management_skill

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:25 AM UTC
• Version: 1.0.1

Overview

This skill is a disclosed ClawHub wrapper, but it encourages and enables high-impact publishing and installation actions without enough validation or user safeguards.

Review carefully before installing. Use the publish helper only for intended skill directories under ~/.openclaw/skills with my_ names, inspect contents for secrets before upload, and avoid installing unpinned or unknown third-party skills unless you trust the publisher and version.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

other

Warning

• Location: scripts/clawhub_helper.sh:13

Finding

Unrestricted Local Directory Publication Can Disclose Sensitive Data

Content

View full analysis

Vulnerability Details

File Location: scripts/clawhub_helper.sh:13-19
Vulnerability Type: Unintended data disclosure through insufficient path validation
Risk Level: Medium

Vulnerable Code

bash

        PATH_SKILL=$2
        VERSION=$3
        CHANGELOG=$4
        SLUG=$(basename "$PATH_SKILL")
        echo "Publishing $SLUG@$VERSION..."
        clawhub publish "$PATH_SKILL" --slug "$SLUG" --name "$SLUG" --version "$VERSION" --changelog "$CHANGELOG"

The related publication policy in SKILL.md:15-26 states that custom skills must be stored under ~/.openclaw/skills/, use the my_ prefix, and be uploaded after local changes. The helper does not enforce those restrictions.

Technical Analysis

The publish operation accepts an arbitrary caller-controlled filesystem path and passes it directly to clawhub publish. It only derives the publication slug from the path's basename. It does not:

• Canonicalize the supplied path.
• Verify that the path is under ~/.openclaw/skills/.
• Require the basename to start with my_.
• Reject symbolic links or path traversal outside the approved directory.
• Review the publication manifest for credentials or other sensitive files.
• Obtain explicit confirmation before transferring directory contents externally.

Shell command injection is not present in this segment because variable expansions used as command arguments are quoted. The vulnerability is instead the absence of semantic validation on which directory may be published.

Attack Path

1. A user, automated agent, or misleading instruction invokes:

   bash

   bash scripts/clawhub_helper.sh publish /path/to/sensitive-directory 1.0.0 "backup"
   

2. The script accepts the directory without confirming that it is an approved custom-skill directory.
3. basename supplies a plausible publication slug but provides no security boundary.
4. The complete selected directory is ...[truncated 886 chars]

Remediation

View remediation

Remediation Suggestions

1. Canonicalize the requested directory with realpath and reject it unless it is a direct child of the canonical ~/.openclaw/skills/ directory.
2. Require the canonical directory basename to match a restrictive pattern such as my_[A-Za-z0-9_-]+.
3. Reject symbolic-link skill directories and define whether symbolic links within a skill are permitted.
4. Generate and display the exact publication manifest before upload.
5. Scan the manifest for secrets, private keys, environment files, and other sensitive content.
6. Require explicit user confirmation before an external upload, particularly when publication visibility is public or unknown.
7. Clearly document ClawHub visibility, retention, and deletion behavior.
8. Fail closed when path validation or secret scanning cannot be completed.

T08 · Insecure Dependencies

Warning

• Location: scripts/clawhub_helper.sh:25

Finding

Unverified and Optionally Unpinned Third-Party Skill Installation

Content

View full analysis

Vulnerability Details

File Location: scripts/clawhub_helper.sh:25-34
Vulnerability Type: Unsafe third-party package acquisition
Risk Level: Medium

Vulnerable Code

bash

        SLUG=$2
        VERSION=$3
        if [ -z "$SLUG" ]; then
            echo "Usage: ./clawhub_helper.sh install <slug> [version]"
            exit 1
        fi
        
        echo "Searching for $SLUG..."
        clawhub search "$SLUG"
        
        if [ -z "$VERSION" ]; then
            echo "Installing latest version of $SLUG..."
            clawhub install "$SLUG"
        else
            echo "Installing $SLUG version $VERSION..."
            clawhub install "$SLUG" --version "$VERSION"
        fi

Technical Analysis

The helper installs arbitrary ClawHub skills based only on a caller-provided slug. A version is optional, so the default path installs the mutable latest release. The helper does not verify:

• Package publisher identity.
• Cryptographic signatures or trusted checksums.
• Whether the package belongs to an approved allowlist.
• Whether the selected search result exactly and uniquely matches the requested package.
• Whether the downloaded package matches reviewed content.
• Whether the package contains executable scripts or hostile skill instructions.

The preceding clawhub search call is informational rather than a security check. Its output is not parsed or validated, and its failure does not necessarily stop execution because the script does not use set -e or explicitly inspect the command's exit status. Consequently, installation proceeds after an unsuccessful search unless the shell or clawhub itself terminates the process.

Attack Path

1. An attacker publishes a typosquatted skill, compromises an existing publisher, or uploads a malicious new version of a legitimate slug.
2. A user or agent supplies that slug to the helper. The version may be omitted ...[truncated 1028 chars]

Remediation

View remediation

Remediation Suggestions

1. Require an explicit immutable version for every installation; reject requests that omit it.
2. Verify publisher identity against a trusted allowlist.
3. Require and validate cryptographic signatures or trusted package checksums.
4. Abort immediately if search, metadata retrieval, signature verification, or checksum validation fails.
5. Confirm that search metadata resolves to one exact package and publisher rather than relying only on a slug.
6. Download packages into a staging area and inspect manifests, scripts, instructions, and requested permissions before activation.
7. Record the approved publisher, version, and digest in a lockfile for reproducible installations.
8. Run installed content with least privilege and isolate executable components where supported.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The description claims a broader management interface with policy enforcement and configuration-driven behavior. The actual code is only a thin CLI wrapper for clawhub publish/install operations. It does not inspect skill names, directories, or configuration files, and it does not monitor or react to local modifications. Additionally, it includes install/search functionality that is not described. This is a material description-behavior mismatch.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md

.openclaw/agents/{agent_name}/skills.json`），将技能名加入到 `"enabled_skills"` 列表中。禁止在 `SKILL.md` 中硬编码“仅限 xxx 使用”等文字描述来实现绑定。

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The publish path claims to manage custom skills under enforced rules, but it performs no validation of the required my_ prefix, expected local storage directory, binding configuration, or mandatory backup semantics before publishing. In a skill-management context, this gap can cause unauthorized or incorrect content to be published as if it had passed policy checks, undermining integrity controls and creating a false sense of security for downstream users or agents.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs immediate cloud upload/backup after any local change, which can cause accidental publication of sensitive content, secrets, proprietary logic, or unreviewed code. In this context—a skill-management and publishing workflow—the risk is elevated because users are encouraged to treat publishing as automatic hygiene rather than a reviewed release step.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest describes a unified interface for managing and publishing user-defined local skills, including enforcing a "my_" prefix, a fixed local storage directory, skills.json binding rules, and mandatory backup upload after local changes. This script implements a separate install workflow that searches for and installs arbitrary skills from ClawHub, which is not described as part of that purpose and does not relate to enforcing the stated local-management constraints.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 75% confidence

Finding

The manifest description includes a mandatory instruction phrased as "强制执行" for how the skill operates, and the overall skill mixes languages without indicating user choice or a justified locale restriction. Because the file does not explain that this skill is intentionally Chinese-only or offer localization choice, it may conflict with language/locale policy expectations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.