ClawHub
Back to skill

Security audit

Skillstore

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly does what it claims, but it can install unverified GitHub skills and write files outside the intended skills area.

Install only if you are comfortable reviewing any GitHub repository before selecting it, and avoid using create/new with untrusted or path-like names. Prefer a version that stages downloads, pins commits, validates skill names, and removes broad behavioral guidelines.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T01 · Skill Instruction Hijacking

Error
Location
guidelines.md:40
Finding

Agent Safety and Decision-Making Instructions Are Overridden

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
main.js:268
Finding

Unverified GitHub Repositories Can Be Installed as Trusted Skills

Content
View full analysis
= MATCH_THRESHOLD) { scoredResults.push({ name: r.name, fullName: r.full_name, desc: r.description || 'No description', url: r.html_url, stars: r.stargazers_count, score, type: 'git' }); } } return scoredResults.sort((a, b) => b.score - a.score); } catch (e) { log('GitHub search unavailable', 'gray'); return []; } } ``` A selected repository is cloned directly into the active Skills directory: ```javascript async function installFromGitHub(repo, name) { log(`\nInstalling ${name} from GitHub...`, 'cyan'); const skillsDir = path.join(__dirname, '..'); const targetDir = path.join(skillsDir, name); if (fs.existsSync(targetDir)) { log(`Skill "${name}" already exists`, 'yellow'); return false; } const cmd = `git clone https://github.com/${repo}.git "${targetDir}"`; return new Promise((resolve) => { exec(cmd, (error) => { if (error) { err(`Failed to install: ${error.message}`); resolve(false); return; } ...[truncated 2790 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
main.js:301
Finding

Unsanitized Skill Names Permit Filesystem Path Traversal

Content
View full analysis
` and `skillstore new ` paths do not. Therefore, the vulnerable command remains directly reachable. ### Attack Pa ...[truncated 1703 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (11)

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill installs code from GitHub search results by invoking git clone into the local skills directory, effectively importing untrusted third-party code based on a search workflow. Even though the repository name comes from GitHub metadata, this creates a supply-chain risk and can expose users to malicious repositories, unsafe post-install content, or later execution of attacker-controlled skill code.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
# SkillStore - OpenClaw Skill Manager

Search, install, and create OpenClaw skills with intelligent matching.

## Skill Metadata

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly supports installing skills from GitHub, which implies fetching and introducing third-party code into the local OpenClaw skill workspace. Without clear warnings, trust boundaries, provenance checks, or review requirements, users may install untrusted skills that can execute harmful logic or persist malicious content locally.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The instruction to write content to markdown whenever a user says a trigger phrase encourages automatic persistence of arbitrary natural-language input without requiring scoping, consent, or sensitivity checks. This can lead to secrets, personal data, or transient context being stored on disk and later exposed through files, version control, logs, or subsequent agent actions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The line mandates that all formal project documentation must be in English only. This is a language policy restriction stated in natural language, but the file does not offer user choice, opt-in, or a documented compliance-based justification for the constraint.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

This markdown guidance tells developers to support multiple command patterns and fuzzy matching, but it does not define boundaries, exclusions, or negative examples for when a skill should not activate. That can encourage ambiguous trigger designs that overlap with ordinary language and cause unintended invocation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The header comment states the tool is for 'search with semantic matching and threshold filtering', but the implementation also clones repositories and creates executable skill scaffolding on disk. This mismatch hides materially different side effects from users and reviewers, increasing the risk of unsafe execution or installation of untrusted content.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · main.js (reported line 187)May include surrounding context.

js
try {
    const results = await httpGet(
      `https://api.github.com/search/repositories?q=openclaw+${encodeURIComponent(query)}+in:name,description&per_page=15`
    );
    
    if (!results.items) return [];

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The install path writes to the local skills directory via git clone without an explicit safety warning that untrusted code is being fetched and stored locally. Users may interpret the prompt as a benign search action and approve installation without understanding the persistence and trust implications.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The skill can create new directories and write multiple files including an executable main.js under a user-influenced name, despite lacking manifest justification or guardrails. While intended as scaffolding, it is still a filesystem-mutating capability that could overwrite expectations, create confusing executables, or be abused in sensitive skill directories.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The create workflow immediately makes directories and writes several files, including an executable script, without a dedicated confirmation or warning about filesystem changes. Although the user invokes create, the absence of a summary/confirmation still reduces transparency and can lead to unintended persistent changes.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
main.js:282