ClawHub
Back to skill

Security audit

skill-list

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a simple local skill-listing helper that overstates some features but does not show malicious behavior.

Install only if you want a lightweight Chinese-language helper for listing local OpenClaw skills. Expect incomplete behavior: duplicate-skill detection, table output, and --category are documented but not actually implemented in the script.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
声明的核心功能包括三点：列出 skills、显示功能介绍、找出重复功能。实际代码确实实现了列出本地 skills 并从 SKILL.md 提取 description，同时还列出 ClawHub 安装的 skills，因此与“列出/显示介绍”部分基本一致。但存在明显偏差：1）代码没有任何重复检测、相似性分析或去重逻辑，无法“找出功能重复的 skills”；2）输出只是普通文本打印，不是表格；3）代码还额外执行了 `clawhub list` 外部命令，这属于描述中未提及的行为。综合来看，描述未准确覆盖实际行为，且遗漏/夸大了重要能力，因此应判定为 mismatch。

Lp3

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding
Without declared permissions the skill's intent is opaque and cannot be validated.

Natural-Language Policy Violations

Medium
Confidence
89% confidence
Finding
The manifest description is written primarily in Chinese with embedded English and presents the skill's usage guidance only in that language. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is clearly documented and justified.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
This Python file contains natural-language docstrings and console output exclusively in Chinese, such as the module description and status messages. Because the skill does not provide any user opt-in or documented justification for a Chinese-only locale, it violates the language/locale policy criteria.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The manifest description promises tabular output, feature descriptions, and finding skills with overlapping functionality. In practice, the script prints skill names and a short extracted description, then dumps `clawhub list` output; there is no table formatting logic and no analysis for duplicate or redundant skills.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
# 也显示 clawhub 安装的
    print("\n\n📦 ClawHub 安装的 Skills:")
    print("=" * 70)
    result = subprocess.run(['clawhub', 'list'], capture_output=True, text=True)
    print(result.stdout)

if __name__ == "__main__":
Confidence
70% confidence
Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Intent-Code Divergence

Low
Confidence
95% confidence
Finding
The file presents itself as a skill manager that lists all OpenClaw skills and identifies duplicate functionality, but the content is a static manually maintained list rather than generated output. It also contains inconsistencies such as referencing 'truth-search' in categories and duplicates despite that skill not appearing in the main list, which contradicts the implied completeness and accuracy of the documentation.

Context-Inappropriate Capability

Low
Confidence
81% confidence
Finding
The stated purpose is to list installed skills and explain what they do. Reading local skill metadata is directly aligned with that purpose, but spawning an external command introduces an additional execution capability that is not clearly justified by the manifest text, especially since the script already reads the local skills directory.

Static analysis

No suspicious patterns detected.