ClawHub 技能发布指南

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:49 AM UTC
• Version: 1.0.0

Overview

This is a publishing guide with no bundled code, but it tells agents to perform broad, account-impacting ClawHub operations without enough scoping or confirmation guidance.

Review carefully before installing or using this skill. Only run its publishing commands from a directory containing approved, publication-ready skills; prefer explicit `clawhub publish <path>` for one skill; inspect dry-run output; and require clear user confirmation before any `sync --all`, hide, delete, or global CLI installation step.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:65

Finding

Non-Interactive Bulk Synchronization Can Publish Unintended Skills

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:65-74
Additional Locations: SKILL.md:153, SKILL.md:181-189, README.md:8-16
Vulnerability Type: Unsafe bulk publication configuration
Risk Level: Medium

bash

# Enter the parent skills directory
cd D:\openclaw-data\workspace\skills

# Preview the skills that will be published
clawhub sync --dry-run

# Publish without per-item confirmation
clawhub sync --all --bump patch --changelog "update description"

Technical Analysis

The documented workflow instructs users to execute clawhub sync from a shared parent directory containing multiple skills. The --all option bypasses interactive confirmation and applies synchronization to every discovered skill.

Although a dry-run command is documented, no technical control requires the user to inspect or approve its manifest. The publication operation is therefore broader than the apparent task of publishing one intended skill. Any unrelated, unfinished, confidential, or attacker-planted skill directory beneath the shared parent directory may be included.

Attack Path

1. A user or another process places an additional skill directory under D:\openclaw-data\workspace\skills.
2. The added directory contains private material, unfinished content, or attacker-controlled files but remains structurally recognizable as a skill.
3. An authenticated publisher follows the documented workflow from the shared parent directory.
4. The publisher runs clawhub sync --all, which skips per-skill confirmation.
5. ClawHub publishes or updates every discovered skill, including the unintended directory.
6. The unintended content becomes accessible through the publisher's ClawHub account according to the resulting publication visibility.

Impact Assessment

Exploitation does not directly grant local operating-system privileges. It abuses the existing permissions of the authenticated ClawHub account.

...[truncated 443 chars]

Remediation

View remediation

Remediation Suggestions

• Make explicitly scoped publication the default:

  bash

  clawhub publish D:\openclaw-data\workspace\skills\your-skill --slug your-skill --version 1.0.0 --changelog "update description"
  

• Do not recommend --all for ordinary single-skill publication.

• Require interactive confirmation for each discovered skill.

• If bulk synchronization is necessary, require the operator to save and review the dry-run manifest before continuing.

• Document that the parent directory must contain only approved, publication-ready skills.

• Add a pre-publication checklist covering secrets, private files, generated artifacts, and unexpected directories.

• Where supported, use an explicit allowlist of skill slugs or paths rather than automatic directory discovery.

T08 · Insecure Dependencies

Note

• Location: README.md:29

Finding

Unpinned Global Installation of the ClawHub CLI

Content

View full analysis

Vulnerability Details

File Location: README.md:29-32
Vulnerability Type: Unpinned globally installed dependency
Risk Level: Low

bash

npm i -g clawhub

Technical Analysis

The documentation recommends globally installing the latest available clawhub npm package without pinning a reviewed version or verifying package integrity. An unpinned installation can resolve to a future release whose code differs from the version reviewed by the project.

npm packages may execute lifecycle scripts during installation. If the registry package, publisher account, or a future release is compromised, the installation can execute attacker-controlled code with the permissions of the user running npm. A global installation also increases the package's influence because its executable becomes available system-wide for that user.

Attack Path

1. An attacker compromises the npm package, its maintainer account, or a future dependency release.
2. The attacker publishes a malicious version under the expected clawhub package name.
3. A user follows the README and runs npm i -g clawhub.
4. npm resolves the unpinned command to the malicious latest version.
5. Malicious lifecycle or CLI code executes with the installing user's privileges.
6. The malicious package can access resources available to that user, potentially including ClawHub credentials and files later submitted for publication.

Impact Assessment

The attainable privileges are those of the account executing npm. The package does not inherently obtain administrator privileges unless npm is run from an elevated shell.

Potential impact includes:

• Execution of arbitrary code as the installing user.
• Theft of locally accessible ClawHub authentication material.
• Modification of files and commands within the user's permission scope.
• Tampering with skills before publication.
• Unauthorized actions through the user's authenticated ClawHub a ...[truncated 96 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the CLI to a reviewed version instead of installing the latest release:

  bash

  npm install --global clawhub@1.2.3
  

• Replace the example version with the specific version tested by the project.

• Document the official package registry, publisher identity, and source repository.

• Verify package provenance, signatures, or registry integrity metadata where supported.

• Review lifecycle scripts before installation and use --ignore-scripts when compatible with the package.

• Prefer a project-local, locked dependency over a global installation when operationally feasible.

• Periodically review and deliberately update the pinned version rather than allowing automatic resolution to an arbitrary future release.

• Warn users not to execute the installation from an elevated shell unless elevated privileges are explicitly required.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The guide includes clawhub hide and clawhub delete as actionable commands without any warning that they can remove public visibility or soft-delete a published skill. In an agent-executed context, this increases the chance of unintended destructive actions if the instructions are followed automatically or out of context.

Content

No source excerpt is available for this finding.