ClawHub
Back to skill

Security audit

Clawhub Skill Creator

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent ClawHub skill-authoring helper, but its packaging script can unintentionally include sensitive files when creating publishable packages.

Install only if you are comfortable reviewing packages before publishing. Do not run the packaging script on directories containing .env files, keys, credentials, private config, or symlinks; inspect the generated archive contents before publishing it to ClawHub.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/package-skill.sh:91
Finding

Unrestricted Recursive Packaging May Disclose Sensitive or Symlink-Targeted Files

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

└── assets/ # Optional: templates, resources

text

### Phase 4: Write SKILL.md

#### Frontmatter (YAML)

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 212)May include surrounding context.

md
**Guidelines:**
- One topic per file
- <5K words per file
- Link from SKILL.md with clear context
- No deeply nested references
- Language: English preferred, domain-specific allowed

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The file explicitly requires the skill description to be in English and repeats that requirement for core metadata and workflow text. Under the policy, forcing a specific language without user opt-in or a documented regional/compliance justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The SKILL.md lists shell scripts such as scripts/init-skill.sh, scripts/package-skill.sh, and scripts/validate.sh as part of the skill's supported workflow, but the anti-patterns section says "Don't ... Use platform-specific scripts (sh/bat)." This is an active contradiction in the guidance because .sh scripts are exactly the kind of platform-specific scripts the document tells users not to use.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/token-optimization.md (reported line 168)May include surrounding context.

Quick check:

bash
# Count words in SKILL.md
wc -w .qwen/skills/my-skill/SKILL.md

# Target: <500 words for metadata + body

Vague Triggers

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

This markdown file is a validation checklist, and at L27 it only checks for the presence of "Use when:" triggers, not their specificity or exclusion conditions. That omission can allow overly broad trigger language to pass validation, increasing the risk of unintended skill invocation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.