Security audit
Security checks for vulnerabilities and agentic risk
The skill has a coherent publishing purpose, but its setup and staging workflow include unsafe execution and file-disclosure risks that users should review before installing.
Install only after replacing the curl-to-bash setup with a versioned, verifiable installer path. Before publishing, review the staged directory recursively, reject symlinks in skills, use a private mktemp-based staging directory, and manually remove staged files from /tmp. Treat SkillHub and ClawHub tokens as account credentials and keep them out of skill directories.
SKILL.md:45Unpinned Remote Installer Is Executed Directly Through a Shell
scripts/prepare-publish.sh:174Tracked Symbolic Links Can Stage Files Outside the Intended Skill Directory
scripts/prepare-publish.sh:131Predictable Shared Temporary Directory Enables Local Interference and Leaves Staged Data Behind
The skill instructs users to fetch a remote shell script and pipe it directly into bash, which removes any opportunity to inspect integrity or content before execution. If the hosting bucket, DNS, CDN path, or transport endpoint is compromised, an attacker can achieve immediate arbitrary code execution on the user's machine during installation.
# 1. 安装 CLI（macOS/Linux）
curl -fsSL https://skillhub-1388575217.cos.ap-guangzhou.myqcloud.com/install/install.sh | bash
# 2. 升级到支持发布的版本（≥ 2026.7.29）
skillhub self-upgrade
The command chains untrusted network content directly into a shell interpreter, combining retrieval and execution in one step. This is especially dangerous in a publishing skill because users are likely to run setup commands as part of enabling release workflows, so a compromised installer can steal tokens, alter files, or implant persistence before any sync occurs.
# 1. 安装 CLI（macOS/Linux）
curl -fsSL https://skillhub-1388575217.cos.ap-guangzhou.myqcloud.com/install/install.sh | bash
# 2. 升级到支持发布的版本（≥ 2026.7.29）
skillhub self-upgrade
Referenced artifact was not completely inspected
> - "Do not add conflicting license terms in `SKILL.md`." —— **禁止在 SKILL.md 内加冲突的许可证条款**。
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
--exclude='node_modules/' # 排除 node_modules
--exclude='__pycache__/' # 排除 Python 缓存
--exclude='.DS_Store' # 排除 macOS 系统文件
--exclude='**/.env' # 排除环境变量文件（防止凭证泄露）
--exclude='**/*.db' # 排除数据库文件
--exclude='**/*.sqlite' # 排除 SQLite 文件
--exclude='**/logs/' # 排除日志目录
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
# 强制清理 rsync 可能遗漏的运行时目录（.gitignore 路径相对于项目根时 rsync 无法匹配）
for _DIR in archive output downloads logs; do
[ -d "$TEMP_DIR/$_DIR" ] && rm -rf "$TEMP_DIR/$_DIR" && echo -e "${YELLOW}强制移除: $_DIR/${NC}"
done
# ── SkillHub 专用:从本地配置注入 slug/displayName 到临时副本 frontmatter ──
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
# 强制清理 rsync 可能遗漏的运行时目录（.gitignore 路径相对于项目根时 rsync 无法匹配）
for _DIR in archive output downloads logs; do
[ -d "$TEMP_DIR/$_DIR" ] && rm -rf "$TEMP_DIR/$_DIR" && echo -e "${YELLOW}强制移除: $_DIR/${NC}"
done
# ── SkillHub 专用:从本地配置注入 slug/displayName 到临时副本 frontmatter ──
The skill documents actions that read environment-backed credentials and update local files such as sync records, but it does not declare any explicit tool/permission scope. In an agent setting, missing scope boundaries can cause overbroad tool access or make reviewers/users unable to assess what the skill is allowed to do, increasing the chance of unintended file modification or credential exposure during publish workflows.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
| 依赖 | 用途 | 安装方式 |
|------|------|----------|
| `rsync` | `prepare-publish.sh` 复制过滤文件到临时发布目录 | macOS 自带；Linux: `sudo apt-get install rsync` |
| `git` | `prepare-publish.sh` 用 `git ls-files` 精确匹配追踪文件 | macOS 自带；Linux: `sudo apt-get install git` |
| Python 3 | 运行腾讯 SkillHub CLI（Python 脚本） | macOS 自带；Linux: `sudo apt-get install python3` |
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
| 依赖 | 用途 | 安装方式 |
|------|------|----------|
| `rsync` | `prepare-publish.sh` 复制过滤文件到临时发布目录 | macOS 自带；Linux: `sudo apt-get install rsync` |
| `git` | `prepare-publish.sh` 用 `git ls-files` 精确匹配追踪文件 | macOS 自带；Linux: `sudo apt-get install git` |
| Python 3 | 运行腾讯 SkillHub CLI（Python 脚本） | macOS 自带；Linux: `sudo apt-get install python3` |
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
| 依赖 | 用途 | 安装方式 |
|------|------|----------|
| `rsync` | `prepare-publish.sh` 复制过滤文件到临时发布目录 | macOS 自带；Linux: `sudo apt-get install rsync` |
| `git` | `prepare-publish.sh` 用 `git ls-files` 精确匹配追踪文件 | macOS 自带；Linux: `sudo apt-get install git` |
| Python 3 | 运行腾讯 SkillHub CLI（Python 脚本） | macOS 自带；Linux: `sudo apt-get install python3` |
L398-L402 明确写明版本号“从技能的 CHANGELOG.md 第一行提取”，而 L224-L225、L584-L584 等多处又将版本来源定义为 SKILL.md frontmatter 中的 version。这不是单纯遗漏，而是对同步判定依据的主动矛盾描述，会直接影响是否发布、如何比较增量版本。
The file’s natural-language instructions and display names are entirely in Chinese, which imposes a specific language/locale on users without offering a choice or opt-in. Under the policy, language constraints should either be optional for users or clearly justified as region-specific; this file does not provide such justification.
This shell script includes its description, usage text, warnings, and status messages entirely in Chinese. The policy flags language/locale constraints when a skill forces a specific language without user opt-in, and this file does not offer any language selection or justify being region-specific.
This markdown file contains natural-language release notes exclusively in Chinese, and there is no indication that users may choose another language or that the file is intentionally limited to a Chinese-only audience. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.
L007 写明“本技能应在用户需要将本地 skills 发布到 ClawHub/SkillHub、批量同步技能、检查发布状态时使用”，这是场景式描述而非明确、可枚举的触发短语，且未说明不应在什么情况下调用。对 markdown 文件而言，这种较宽泛的激活条件可能与一般性的“检查发布状态”或“同步技能”请求重叠。
L015 的自然语言描述将平台直接定位为“专为中国用户优化”，可能被理解为默认按特定地区/语言人群路由或偏向，但文档未同时说明这是平台特性介绍而非技能的强制语言/地区策略。按组织语言/locale 政策，这类定向表述若无选择机制或明确限定，存在轻微合规风险。
The file’s explanatory comments are entirely in Chinese, which imposes a specific language on users reading or maintaining the template. Under the policy rule for natural-language violations, this can be considered a locale/language constraint because the file does not offer an alternative language or explain that it is intentionally region-specific.
No suspicious patterns detected.