ClawHub
Back to skill

Security audit

Automatic Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed automation factory for creating and publishing skills, but it can use your GitHub and ClawHub accounts for unattended public publishing and daily scheduled runs.

Install only if you intentionally want an autonomous skill factory. Start with dry-run, avoid enabling the daily cron until you have reviewed outputs, prefer the PR workflow over direct pushes, use dedicated least-privilege tokens, and revoke tokens plus remove the cron job if you stop using it.

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (9)

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The script only emits prompt text via console.log, but the generated instructions explicitly state that pipeline state will be written back to data/current-pipeline.json and that Stage 3 should be executed next. In an autonomous skill-generation pipeline, this mismatch can cause downstream agents or operators to assume state changes and stage transitions occurred when they did not, creating unsafe automation behavior and integrity failures in the release process.

Intent-Code Divergence

Medium
Confidence
94% confidence
Finding
The script presents itself as a self-check gate and instructs downstream automation to update pipeline state and proceed to upload, but it never performs those actions itself; it only prints a prompt. In a fully automated skill factory, this creates a dangerous integrity gap where operators or agents may assume verification occurred and publish unvalidated artifacts, including unsafe or noncompliant skills.

Intent-Code Divergence

Medium
Confidence
96% confidence
Finding
The stage banner says 'Perform a rigorous self-check' and labels this as the last gate before upload, but the code only outputs a checklist for another agent to follow. In the context of an autonomous publish pipeline, this mismatch can bypass security and quality controls because the pipeline appears to have a verification stage without enforcing one.

Intent-Code Divergence

Medium
Confidence
93% confidence
Finding
The header comment says the script makes no outbound network requests, but it generates an agent prompt that explicitly instructs downstream execution of GitHub and clawHub operations. This mismatch can mislead reviewers and operators into underestimating the script's real operational effect, increasing the chance that privileged publish/push actions are triggered without adequate scrutiny.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The activation criteria are broad enough to match common user requests such as generating, iterating, or publishing a skill, which can cause the skill to trigger in situations where the user did not intend to delegate repo-writing or publishing workflows. In a skill that handles tokens, cron registration, repo creation, and public publishing, ambiguous invocation increases the risk of unintended high-impact actions.

Vague Triggers

Medium
Confidence
86% confidence
Finding
The in-scope examples are vague and do not sharply separate harmless status queries from action-oriented publishing or iteration requests. Because this skill is capable of persistent changes and external publication, ambiguous triggers can lead to accidental execution of sensitive stages without sufficiently clear user authorization.

Vague Triggers

Medium
Confidence
96% confidence
Finding
The package description advertises a very broad, fully autonomous capability set: researching, generating, testing, and publishing skills with zero human intervention. In an agent ecosystem, vague invocation scope combined with autonomous publication actions can cause the skill to be selected in situations beyond its safe operating boundary, enabling unintended code generation, repository changes, or production publishing without adequate user confirmation.

Session Persistence

Medium
Category
Rogue Agent
Content
---
name: automatic-skill
description: |
  每日 Skill 自动工厂 — 让 openclaw 和 Claude 完全自主地调研、设计、生成、测试并发布全新 skill，全程零人工介入。内置 10 阶段流水线（Research → Design → SEO → Create → Review → Self-Run → Self-Check → Upload → Verify → Final Review），每天凌晨 02:00 自动选题跑完整流程，输出推送到 GitHub 和 clawHub 的生产级 skill。也可手动指定 idea 触发，或单独调用某一阶段进行调试/迭代。支持用自身流水线对已有 skill 做升级、SEO 优化和重新发布。Use it when the user asks to auto-generate a skill, check daily pipeline status, iterate an existing skill, or publish to GitHub and clawHub.
keywords:
  - automatic-skill
  - 自动skill
Confidence
87% confidence
Finding
The skill explicitly supports a daily 02:00 automated pipeline and persistent cron registration, which creates ongoing autonomous behavior beyond the current session. In the context of a skill that can create repos, push commits, and publish artifacts, persistence materially raises risk because a single enablement can cause repeated future actions using locally available credentials.

Session Persistence

Medium
Category
Rogue Agent
Content
在 shell 环境中设置以下变量（写入 `~/.zshrc` 或 `~/.bashrc`）：

```bash
export GITHUB_TOKEN=<your-github-token>          # repo write scope
export GITHUB_REPO=<owner/repo>                  # e.g. Cosmofang/openclaw-skills
export CLAWHUB_TOKEN=<your-clawhub-token>
export CLAWHUB_OWNER_ID=<your-owner-id>          # optional
Confidence
82% confidence
Finding
The documentation instructs users to place write-capable tokens in persistent shell startup files like ~/.zshrc or ~/.bashrc, extending credential exposure across sessions and unrelated processes. Persistent storage of powerful tokens is risky because any later compromise of the user environment, shell history mishandling, or over-broad process access can reuse those credentials for repo writes or publishing.

Static analysis

No suspicious patterns detected.