ClawHub
Back to skill

Security audit

Skill Auto Publish

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed ClawHub publishing helper that can update public skill pages, but its behavior is coherent with that purpose and bounded by checks and verification steps.

Install this only if you want an agent to help publish ClawHub skills. Before allowing publish commands, confirm the logged-in ClawHub account, slug, source path, version, changelog, and that any required release review is complete, because successful use can update public marketplace content.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
88% confidence
Finding
This markdown file instructs the agent to run `clawhub publish` after local file updates and treats the task as incomplete until the publish occurs. Because publishing changes a public page and can affect user-visible data, the guidance should include an explicit warning or confirmation expectation before performing that action.

Static analysis

No suspicious patterns detected.