Security audit
Security checks for vulnerabilities and agentic risk
This is a real security-scanning helper, but its installer can delete unintended files and runs unpinned remote code, so it needs review before installing.
Treat this as a Review item before installation. Do not run it as-is on important workspaces or with elevated privileges. At minimum, validate skill slugs against a strict allowlist, canonicalize and contain every delete or move path, remove or strongly gate --skip-scan, pin mcp-scan to a reviewed version, and avoid curl-to-shell dependency setup.
SKILL.md:96Unverified Remote Installer Is Piped Directly Into a Shell
scripts/safe-install.sh:126Security Scanner Executes an Unpinned Latest Dependency
scripts/safe-install.sh:97Unvalidated Skill Slug Enables Path-Traversal Deletion
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
---
name: skill-guard
description: Scan ClawHub skills for security vulnerabilities BEFORE installing. Use when installing new skills from ClawHub to detect prompt injections, malware payloads, hardcoded secrets, and other threats. Wraps clawhub install with mcp-scan pre-flight checks.
---
# skill-guard
**The only pre-install security gate for ClawHub skills.**
## Why skill-guard?
| | **VirusTotal** (ClawHub built-in) | **skillscanner** (Gen Digital) | **skill-guard** |
|---|---|---|---|
| **When it runs** | After publish (server-side) | On-demand lookup | **Before install (client-side)** |
| **What it checks**
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
| **AI-specific threats** | ❌ | ❌ | ✅ |
| **Install blocking** | ❌ | ❌ | ✅ |
**VirusTotal** catches known malware binaries — but won't flag `<!-- IGNORE PREVIOUS INSTRUCTIONS -->`.
**skillscanner** checks if Gen Digital has reviewed it — but can't scan new or updated skills.
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
| **AI-specific threats** | ❌ | ❌ | ✅ |
| **Install blocking** | ❌ | ❌ | ✅ |
**VirusTotal** catches known malware binaries — but won't flag `<!-- IGNORE PREVIOUS INSTRUCTIONS -->`.
**skillscanner** checks if Gen Digital has reviewed it — but can't scan new or updated skills.
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
t-side)** |
| **What it checks** | Malware signatures | Their database | **Actual skill content** |
| **Prompt injections** | ❌ | ❌ | ✅ |
| **Data exfiltration URLs** | ❌ | ❌ | ✅ |
| **Hidden instructions** | ❌ | ❌ | ✅ |
| **AI-specific threats** | ❌ | ❌ | ✅ |
| **Install blocking** | ❌ | ❌ | ✅ |
**VirusTotal** catches known malware binaries — but won't flag `<!-- IGNORE PREVIOUS INSTRUCTIONS -->`.
**skillscanner** checks if Gen Digital has reviewed it — but can't scan new or updated skills.
**skill-guard** uses [mcp-scan](https://github.com/invariantlabs-ai/mcp-scan) (Invariant Labs, acquired by Snyk) to analyze what's actually in the skill, catches AI-specific threats, and blocks install if issues are found.
## The Problem
Skills can contain:
- 🎭 **Prompt injections** — hidden "ignore previous instructions" attacks
- 💀 **Malware payloads** — dangerous commands disguised in natural language
- 🔑 **Hardcoded secrets** — API keys, t
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
## The Problem
Skills can contain:
- 🎭 **Prompt injections** — hidden "ignore previous instructions" attacks
- 💀 **Malware payloads** — dangerous commands disguised in natural language
- 🔑 **Hardcoded secrets** — API keys, tokens in plain text
- 📤 **Data exfiltration** — URLs that leak your conversations, memory, files
Referenced artifact was not completely inspected
./scripts/safe-install.sh some-skill
Referenced artifact was not completely inspected
./scripts/safe-install.sh some-skill
Referenced artifact was not completely inspected
./scripts/safe-install.sh some-skill
Referenced artifact was not completely inspected
./scripts/safe-install.sh some-skill
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Skill stays in `/tmp/skill-guard-staging/skills/<slug>/` (quarantined). You can:
1. **Review** — read the scan output, inspect the files
2. **Install anyway** — `mv /tmp/skill-guard-staging/skills/<slug> ~/.openclaw/workspace/skills/`
3. **Discard** — `rm -rf /tmp/skill-guard-staging/`
## Requirements
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Skill stays in `/tmp/skill-guard-staging/skills/<slug>/` (quarantined). You can:
1. **Review** — read the scan output, inspect the files
2. **Install anyway** — `mv /tmp/skill-guard-staging/skills/<slug> ~/.openclaw/workspace/skills/`
3. **Discard** — `rm -rf /tmp/skill-guard-staging/`
## Requirements
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Skill stays in `/tmp/skill-guard-staging/skills/<slug>/` (quarantined). You can:
1. **Review** — read the scan output, inspect the files
2. **Install anyway** — `mv /tmp/skill-guard-staging/skills/<slug> ~/.openclaw/workspace/skills/`
3. **Discard** — `rm -rf /tmp/skill-guard-staging/`
## Requirements
The script deletes a path derived in part from user-controlled SKILL_SLUG using rm -rf. Although quoted, there is no validation that the slug is a simple safe name; path traversal or unexpected path components could cause deletion outside the intended staging subtree if a malicious slug is accepted.
stage_skill() {
print_info "Fetching $SKILL_SLUG to staging area..."
rm -rf "$STAGING_DIR/skills/$SKILL_SLUG"
mkdir -p "$STAGING_DIR"
# Install to staging directory (clawhub creates skills/<slug> under workdir)
With --force, the script recursively deletes $SKILLS_DIR/$SKILL_SLUG, where the final path is influenced by user input and an environment-controlled base directory. If either value is manipulated, the command could remove arbitrary directories, making this a potentially destructive path traversal issue.
if [[ -d "$SKILLS_DIR/$SKILL_SLUG" ]]; then
if [[ -n "$FORCE_ARG" ]]; then
rm -rf "$SKILLS_DIR/$SKILL_SLUG"
else
print_error "Skill already exists at $SKILLS_DIR/$SKILL_SLUG (use --force to overwrite)"
exit 1
Cleanup uses rm -rf on a path incorporating the skill slug without canonical path safety checks. A crafted slug could cause cleanup to target unintended filesystem locations, especially because this function may run automatically after installation attempts.
# Cleanup staging
cleanup() {
rm -rf "$STAGING_DIR/skills/$SKILL_SLUG" 2>/dev/null || true
}
# Main flow
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
echo "Options:"
echo " 1. Review the issues above and decide if they're acceptable"
echo " 2. Run: mv $STAGING_DIR/skills/$SKILL_SLUG $SKILLS_DIR/ to install anyway"
echo " 3. Run: rm -rf $STAGING_DIR/skills/$SKILL_SLUG to discard"
echo ""
exit 2 # Exit code 2 = issues found, not installed
fi
The skill documentation describes shell-based installation and cleanup flows, but the manifest does not declare any explicit tool scope such as permissions or allowed-tools. In an agent ecosystem, missing tool constraints can cause the skill to be granted broader shell capability than intended, increasing the blast radius if the skill or a dependent script is compromised.
The header comment states the skill scans before installing, but actual behavior allows scanning to be skipped. This mismatch is security-relevant because operators may rely on the documented guarantee and unknowingly deploy unscanned content.
The script markets itself as a secure pre-install scanner, yet exposes a first-class --skip-scan option that installs unreviewed skills. This weakens the trust model around the tool and makes accidental or socially engineered bypass of the security gate much more likely.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
echo ""
echo "Options:"
echo " --version <ver> Install specific version"
echo " --force Overwrite existing installation"
echo " --skip-scan Skip security scan (not recommended)"
echo " --help Show this help"
echo ""
uvx/uv tool run commands without ==version create a rug-pull risk.
The script executes uvx mcp-scan@latest, which intentionally pulls the latest scanner version at runtime rather than a pinned, reviewed version. This creates a supply-chain and reproducibility risk: a compromised or breaking upstream release could alter scan behavior, miss detections, or execute unexpected code during what is supposed to be a security control.
The documentation recommends piping a remote install script directly into the shell. This creates a supply-chain risk because network-delivered code executes immediately without integrity verification, allowing compromise if the source, transport, or DNS path is tampered with.
## Requirements
- `clawhub` CLI — `npm i -g clawhub`
- `uv` — `curl -LsSf https://astral.sh/uv/install.sh | sh`
## Why This Matters
The script recommends installing a dependency with curl ... | sh, a classic unsafe pattern that executes remote content directly in a shell without local verification. Even though it is only printed as guidance, users may copy-paste it, making the tool an amplifier for supply-chain compromise if the remote installer or network path is abused.
source "$HOME/.local/bin/env"
fi
if ! command -v uvx &> /dev/null; then
print_error "uvx not found. Install uv with: curl -LsSf https://astral.sh/uv/install.sh | sh"
exit 1
fi
fi
Detected: suspicious.prompt_injection_instructions