ClawHub
Back to skill

Security audit

Skill Curator

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent curator purpose, but it automatically turns arbitrary URLs into persistent Skill files and pushes them to GitHub with too little scoping or review.

Install only if you are comfortable with the agent fetching user-submitted URLs, sending some content to external analysis services, and automatically pushing changes to a GitHub skill repository. Before use, require manual review of diffs, restrict URL targets and keyword names, keep the GitHub token narrowly scoped, and avoid feeding private or sensitive URLs unless the external-processing path is acceptable.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T02 · Agent Memory Poisoning

Error
Location
SKILL.md:90
Finding

Persistent Agent Memory Poisoning Through Untrusted Extracted Content

Content
View full analysis
<内容摘要> 来源： ``` 3. 如果现有 Skill 已包含相同内容（重复检测），跳过不重复添加 ``` ### Technical Analysis The workflow retrieves content from an arbitrary user-supplied webpage and appends the extracted material directly to a persistent `SKILL.md` file. A Skill file can be interpreted by an AI agent as instructions rather than passive data. The specification does not require sanitization, instruction detection, provenance labeling, trust validation, or isolation between executable instructions and externally sourced knowledge. An attacker can therefore place prompt-injection content in a webpage and submit that page for extraction. If the extraction preserves the malicious text, it becomes part of the generated Skill and is pushed to the configured GitHub repository. The attack persists beyond the original request and can affect future sessions whenever an agent loads the poisoned Skill. Duplicate detection does not mitigate this issue because it only prevents repeated insertion; it does not determine whether imported content is safe. ### Attack Path 1. An attacker publishes a webpage containing legitimate-looking material and embedded instructions directed at an AI agent. 2. The attacker sends a message such as `【python】https://attacker.example/article`. 3. The workflow retrieves the webpage through `extract_content_from_websites`. 4. The malicious instructions are included in the extracted text or generated summary. 5. The workflow appends that material to `skills/python/SKILL.md`. 6. The modified Skill is committed and pushed to the p ...[truncated 860 chars]
Remediation
View remediation
.md` or structured JSON, and clearly mark it as untrusted quoted material. 3. Add prompt-injection detection for instructions that attempt to change roles, override policies, invoke tools, access secrets, or direct future agents. 4. Strip hidden HTML, comments, metadata, scripts, encoded text, and instruction-like control content before storage. 5. Wrap imported text in an explicit data boundary and instruct consuming agents never to treat that section as commands. 6. Maintain source provenance, retrieval time, content hashes, and trust status for every imported document. 7. Require human review and approval before modifying or publishing any executable Skill file. 8. Apply repository protections, including pull-request review, signed commits where practical, and restricted write credentials. 9. Test generated Skills in an isolated environment before merging them into the main branch. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:72
Finding

Repository Path Traversal Through an Unvalidated Keyword

Content
View full analysis
/SKILL.md` ``` ### Technical Analysis The Skill derives a filesystem destination from the user-controlled `keyword`, but it does not specify character restrictions, normalization, canonicalization, or a containment check. Accepting arbitrary English or Chinese keywords is not equivalent to validating a safe directory name. A keyword containing path separators, traversal components such as `..`, absolute-path syntax, or platform-specific path constructs could cause the resolved destination to leave the intended `skills/` directory. Because the workflow subsequently generates or updates a file and automatically pushes repository changes, unsafe path construction could modify unrelated tracked files. The precise files reachable would depend on the implementation of the unspecified path-writing component and its working directory. Nevertheless, the documented design lacks the controls required to guarantee that writes remain under the intended repository directory. ### Attack Path 1. An attacker submits a message whose keyword includes traversal or path-separator components. 2. The workflow parses the keyword without applying a safe-slug policy. 3. The workflow interpolates the keyword into `skills//SKILL.md`. 4. Filesystem path resolution normalizes the traversal components. 5. The resulting write targets a location outside the intended keyword directory. 6. The workflow creates or overwrites the target file. 7. The unintended repository modification is committed and pushed to the main branch. ### Impact Assessment Exploitation may permit modification or poisoning of repository files outside `skills//`, subject to the permissions o ...[truncated 437 chars]
Remediation
View remediation
/SKILL.md` can be staged by this workflow. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:64
Finding

Server-Side Request Forgery Through Unrestricted URL Extraction

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.

md
## 环境变量

需要设置：
- `GITHUB_TOKEN`：GitHub Personal Access Token（拥有 repo push 权限）
- `MINIMAX_API_KEY`：MiniMax API Key（用于音视频分析）

## 错误处理

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill description says it will curate content, but it does not clearly warn users that triggering it causes local file modification and an automatic git push to a GitHub repository. That can lead to users unintentionally authorizing persistent changes to a repo, which is a meaningful integrity and consent problem in an automated agent workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The workflow routes submitted URLs and fetched content to third-party tools and services such as MiniMax and website extraction tooling, but the skill does not present a clear privacy notice to the user. This can expose private, sensitive, or proprietary URLs/content to external processors without informed consent, especially if the user assumes processing is local.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.