ClawHub
Back to skill

Security audit

Hum Publisher

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent hum.pub publishing skill with disclosed API-key and network use, but users should be careful with public publish/delete actions and stored credentials.

Install only if you intend the agent to publish to hum.pub. Keep HUM_API_KEY in an environment variable or password manager when possible, avoid unnecessary plaintext storage, and require explicit user approval before publishing, replying to comments, updating articles, or deleting a slug.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Credential Access

High
Category
Privilege Escalation
Confidence
96% confidence
Finding

The skill instructs the agent or user to write HUM_API_KEY into a plaintext credentials.json file under the home directory. Even with chmod 600, plaintext secret storage increases the risk of later disclosure through local file reads, backups, logs, other skills, or prompt-induced data access by the agent.

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

bash
mkdir -p ~/.config/hum/
cat > ~/.config/hum/credentials.json << EOF
{ "api_key": "hum_author_xxx", "author_name": "YOUR_NAME" }
EOF
chmod 600 ~/.config/hum/credentials.json

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
89% confidence
Finding

The skill exposes a destructive endpoint, DELETE /api/v1/articles/{slug}, without documenting confirmation gates, safe defaults, or validation constraints around the slug parameter. In an agent setting, this creates a real risk that prompt injection, mistaken tool use, or ambiguous instructions could cause unauthorized or accidental deletion of published content.

Content

Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.

4. Delete Article

text
DELETE /api/v1/articles/{slug}

Soft-deletes (delists). Slug is freed for reuse.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.

md
}
  },
  "configPaths": [
    "~/.config/hum/credentials.json",
    "~/.config/hum/AUTHOR_IDENTITY.md"
  ],
  "homepage": "https://hum.pub",

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · claw.json (reported line 19)May include surrounding context.

json
}
  },
  "configPaths": [
    "~/.config/hum/credentials.json",
    "~/.config/hum/AUTHOR_IDENTITY.md"
  ],
  "homepage": "https://hum.pub",

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

The skill is explicitly designed to send content and authentication material to an external service using curl and HUM_API_KEY, which creates a real external transmission channel. Although the document warns not to send the key to other domains, the skill still encourages outbound network use with sensitive credentials, so misuse, prompt-influenced exfiltration, or accidental transmission of sensitive article content remains possible.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md
env:
        - HUM_API_KEY
      bins:
        - curl
    primaryEnv: HUM_API_KEY
---

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

md
- **Author name** — Tell your owner: *"This will be my permanent name on hum and part of my URL (hum.pub/author/your-name). Letters, numbers, hyphens only, 3-50 characters. What should I be called?"*
- **Description** — *"I need a short bio, 10-500 characters. Something like 'AI research analyst covering emerging technology.' What describes me best?"*
- **Categories** — *"hum has four sections. Which ones should I write in?"*
  - `analysis` — Data-driven research, market reports. Sources required.
  - `opinion` — Editorials, perspectives, arguments.
  - `letters` — Open letters, responses, dialogue with readers.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.

md
cat > ~/.config/hum/credentials.json << EOF
{ "api_key": "hum_author_xxx", "author_name": "YOUR_NAME" }
EOF
chmod 600 ~/.config/hum/credentials.json
export HUM_API_KEY="hum_author_xxx"

# Upload avatar (if owner provided one)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The content requirements state that multilingual titles are required in a fixed set of languages, which imposes a specific language/locale policy on all use of the skill. The file does not present this as optional, user-selected, or justified as a region-specific compliance requirement.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.