ClawHub
Back to skill

Security audit

Skill Release

Security checks for vulnerabilities and agentic risk

Overview

This skill helps publish ClawHub skills and the sensitive actions it performs are disclosed and aligned with that purpose.

Install only if you intend to let the agent publish or update skills on ClawHub. Use dry-run/check first, verify the ClawHub account and target directory, review any SKILL.md version change before publishing, and consider installing a reviewed pinned clawhub CLI version rather than an unpinned global npm latest install.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:89
Finding

Unpinned Global npm Package Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 89–92
Vulnerability Type: Supply-chain exposure through an unpinned globally installed dependency
Risk Level: Medium

Complete Code Snippet:

bash
## 安装依赖

```bash
npm i -g clawhub
clawhub login
text

The same unsafe installation command is also documented in:
- `prompts/main.md`, lines 13–15
- `README.md`, lines 55–58

### Technical Analysis

The skill directs users to install the mutable latest version of the `clawhub` npm package globally:

```bash
npm i -g clawhub

No exact package version, lockfile, integrity hash, provenance check, or verified package-owner guidance is provided. npm packages may execute lifecycle scripts during installation. Because this installation is global, malicious installation behavior would run with the invoking user's privileges and could affect globally available executables.

This finding does not establish that the current clawhub package is malicious. The vulnerability is the unsafe dependency acquisition process: a compromised package account, registry entry, release pipeline, or unsafe future release could turn the documented command into a local code-execution channel.

Attack Path

  1. An attacker compromises the npm package account, publishing pipeline, or another component responsible for distributing clawhub.
  2. The attacker publishes a malicious release under the same package name and includes a harmful npm lifecycle script or executable.
  3. A user follows the skill's documented npm i -g clawhub instruction.
  4. npm resolves the mutable current release because no exact reviewed version is specified.
  5. npm installs the package globally and may execute attacker-controlled lifecycle code.
  6. The payload runs with the user's privileges and can modify files and global command-line tooling accessible to that account.

Impact Assessment

Successful exploitation could provi ...[truncated 555 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace the mutable install command with a reviewed exact version, for example:
    bash
    npm install --global clawhub@<reviewed-exact-version>
  2. Document the official npm registry location and verified package owner so users can detect typosquatting or registry substitution.
  3. Verify package provenance, signatures, or published integrity metadata before recommending a release.
  4. Prefer a project-local, least-privileged installation over a global installation where supported.
  5. Avoid running npm with administrative privileges.
  6. Review lifecycle scripts and package contents before approving version updates.
  7. Keep the pinned command consistent in SKILL.md, prompts/main.md, and README.md.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (10)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

There is a material mismatch between the declared purpose and the actual code behavior. The description promises operational registry actions—publish, update skill version, release to ClawHub, and manage versions. However, the supplied script is strictly a validation/preflight utility: it runs local/CLI checks (clawhub -V, clawhub whoami), parses local SKILL.md frontmatter, and optionally calls clawhub inspect to see whether a slug already exists. These are supportive checks related to publishing readiness, but they do not themselves carry out publishing or version management. The actual primary purpose is readiness assessment, not publication or registry management.

Content

No source excerpt is available for this finding.

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

The skill explicitly supports updating skill versions and instructs modifying SKILL.md, which is a form of self-modification of agent assets. In context this appears intended for legitimate release management, but self-modifying behavior is still sensitive because it can alter operational logic or metadata and could be abused to introduce malicious changes or silently change future behavior.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: clawhub-deploy
description: Publish and manage Claude Code skills on ClawHub (clawhub.ai). Use when user wants to "publish skill", "update skill version", "release to clawhub", "clawhub publish", "clawhub update", or manage skill versions on the ClawHub registry.
version: 1.0.0
metadata:
  openclaw:

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · scripts/publish.py (reported line 136)May include surrounding context.

python
def main() -> int:
    parser = argparse.ArgumentParser(description="Publish or update skill on ClawHub")
    parser.add_argument("--path", "-p", type=str, default=".", help="Skill directory path")
    parser.add_argument("--slug", "-s", type=str, help="Skill slug (default: read from SKILL.md)")
    parser.add_argument("--version", "-v", type=str, help="Version to publish (auto-bump if omitted)")

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding

The skill instructs the agent to use shell commands and to read and modify local files, but it does not declare any explicit tool scope such as allowed-tools or permissions. That makes the operational boundary unclear and increases the chance the agent will invoke broader capabilities than intended when handling publishing or version-update flows.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The file presents the skill title and core descriptive content in Chinese, which can force a specific language/locale on users without opt-in. The policy allows locale constraints only when documented and justified or when users are given a choice, neither of which appears here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The entire skill prompt is written as a Chinese-only assistant persona and interaction style, with no indication that the user may choose another language. This can violate language/locale policy when a skill imposes a specific language without opt-in or documented justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill instructs the agent to automatically update SKILL.md as part of the version update flow, but it does not require explicit user consent or a warning that a local file will be modified. In an agentic environment, silent file edits can surprise users, alter source-controlled content, and create integrity or workflow issues if the wrong path or version is chosen.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/check.py (reported line 16)May include surrounding context.

python
def run_cmd(cmd: list[str], timeout: int = 30) -> tuple[int, str, str]:
    """Run a shell command."""
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
        return result.returncode, result.stdout, result.stderr
    except FileNotFoundError:
        return 1, "", f"Command not found: {cmd[0]}"

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/publish.py (reported line 16)May include surrounding context.

python
def run_cmd(cmd: list[str], timeout: int = 30) -> tuple[int, str, str]:
    """Run a shell command."""
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
        return result.returncode, result.stdout, result.stderr
    except FileNotFoundError:
        return 1, "", f"Command not found: {cmd[0]}"

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README presents publish and update commands that change external registry state, but it does not explicitly warn users that these actions can create or modify publicly published skill versions. In a deployment-oriented skill, this omission can lead to accidental releases or unintended version updates, especially when users copy commands directly from documentation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.