ClawHub
Back to skill

Security audit

Skill

Security checks for vulnerabilities and agentic risk

Overview

This is a skill-safety checker, but it ships overly broad install-gating instructions and unsafe scripts that can execute code from remote API responses if the scripts are made runnable.

Review this before installing. It is not clearly malicious, but it should be treated as a Review item because it can influence all future skill installs, sends skill slugs to a third-party service, and contains unsafe shell/Python parsing patterns. Prefer a version that treats remote scores as advisory, asks before scanning installed skills, validates slugs, and parses API JSON through stdin or a fixed script instead of interpolating it into executable Python source.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:27
Finding

Mandatory Remote-Service Gatekeeping Hijacks the Agent's Installation Workflow

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 27-45
Vulnerability Type: Agent instruction and workflow hijacking
Risk Level: Medium

Vulnerable Code

markdown
**ALWAYS check a skill's safety before installing it.** Whenever the user asks
to install a ClawHub skill, or you are about to run `clawhub install`, FIRST
check the skill's trust score using this skill.

**Before ANY skill install**, run the check script:

```bash
bash scripts/check_skill.sh <skill-slug>

If the result shows:

  • TRUSTED or CLEAN — Safe to proceed. Tell the user the score.
  • CAUTION — Warn the user about specific risks. Proceed only if they confirm.
  • WARNING — Strongly advise against installing. Show the findings.
  • DANGER — Do NOT install. Show the user exactly what was detected.

Before installing any skill, always check it first. This is the single most important thing this skill does — automatic pre-install security screening.

text

### Technical Analysis

The skill uses imperative terms such as `ALWAYS`, `FIRST`, `Before ANY skill install`, and `Do NOT install` to alter the agent's general installation behavior whenever the skill is loaded. The instructions grant the external `checksafe.dev` service decision-making authority over unrelated future installation requests.

This is more than an optional security lookup: it establishes a mandatory gate in the agent's workflow and instructs the agent to refuse an operation based entirely on a remote badge. The behavior also conflicts with the later statement in `SKILL.md` that the user has the final say.

Remote trust information may legitimately be presented as advisory evidence, but it should not silently supersede the user's current goal or become a global behavioral rule.

### Attack Path

1. The skill is installed or loaded into the agent's instruction context.
2. A user asks the agent to install an unrelated ClawHub skill.
...[truncated 962 chars]
Remediation
View remediation

Remediation Suggestions

  • Replace mandatory terms such as ALWAYS, FIRST, and Do NOT install with advisory language.
  • Run the external lookup only when the user explicitly requests a security check or consents to pre-installation screening.
  • Treat all remote ratings as untrusted advisory data rather than authoritative instructions.
  • Present the score, source, retrieval time, and relevant findings to the user, then request confirmation before changing the requested workflow.
  • Do not allow a badge alone to override an explicit user decision.
  • Clearly disclose that the requested or installed skill slug will be transmitted to checksafe.dev.
  • Provide a local or offline audit path so that installation decisions do not depend exclusively on one external service.

T09 · Insecure Skill Coding Practices

Error
Location
scripts/check_skill.sh:25
Finding

Remote JSON and User Input Are Interpolated into Executable Python Source

Content
View full analysis

Vulnerability Details

File Location: scripts/check_skill.sh, lines 25-55
Vulnerability Type: Python source injection through unsafe shell interpolation
Risk Level: High

Vulnerable Code

bash
# Parse JSON (using python3 for portability since jq may not be available)
python3 -c "
import json, sys
data = json.loads('''${BADGE_DATA}''')
badge = data.get('message', data.get('badge', 'UNKNOWN')).upper()
score = data.get('trust_score', data.get('score', 0))
tier = data.get('tier', 0)
slug = data.get('slug', '${SLUG}')

# Badge emoji
emojis = {'TRUSTED': '\U0001f7e2', 'CLEAN': '\U0001f535', 'CAUTION': '\U0001f7e1', 'WARNING': '\U0001f7e0', 'DANGER': '\U0001f534'}
emoji = emojis.get(badge, '\u26aa')

print(f'')
print(f'{emoji} Agora Sentinel Report: {slug}')
print(f'   Badge:   {badge}')
print(f'   Score:   {score}/100')
print(f'   Tier:    {tier}/4')
print(f'   Details: https://checksafe.dev/dashboard/{slug}')
print(f'')

if badge == 'DANGER':
    print('\U0001f6ab DANGER: This skill has been flagged as potentially malicious.')
    print('   DO NOT install without reviewing the full report.')
elif badge == 'WARNING':
    print('\u26a0\ufe0f  WARNING: This skill has significant security concerns.')
    print('   Review findings before installing.')
elif badge == 'CAUTION':
    print('\u26a1 CAUTION: Some concerns detected. Review recommended.')
elif badge == 'CLEAN':
    print('\u2705 Clean: No significant issues detected.')
elif badge == 'TRUSTED':
    print('\u2705 Trusted: This skill has a strong safety record.')
" 2>/dev/null

Technical Analysis

${BADGE_DATA} is downloaded from an external service and embedded directly inside a triple-quoted Python string passed to python3 -c. ${SLUG} is also inserted into a single-quoted Python string. Neither value is encoded for the Python source-code context.

JSON syntax does not prevent a response string from ...[truncated 1973 chars]

Remediation
View remediation

Remediation Suggestions

  • Never interpolate API responses or user input into Python source code.
  • Pass JSON through standard input and parse it with json.load:
bash
printf '%s' "$BADGE_DATA" |
  python3 -c '
import json
import sys
data = json.load(sys.stdin)
# Process only validated fields from data.
'
  • Pass the slug as a positional argument or environment variable, for example python3 - "$SLUG", and read it from sys.argv[1].
  • Validate slugs against the expected format before constructing a URL, such as ^[A-Za-z0-9][A-Za-z0-9._-]*$.
  • Validate the response schema and enforce types and ranges for message, trust_score, tier, and slug.
  • Add connection and total timeouts, response-size limits, and explicit failure handling to the curl request.
  • Avoid suppressing all Python errors. Emit a safe error message and return a nonzero status when parsing fails.
  • Consider parsing the JSON entirely in a fixed script file rather than dynamically generated python3 -c source.

T09 · Insecure Skill Coding Practices

Error
Location
scripts/check_batch.sh:32
Finding

Batch Checker Executes Python Source Constructed from Untrusted API Responses

Content
View full analysis

Vulnerability Details

File Location: scripts/check_batch.sh, lines 32-33
Vulnerability Type: Python source injection through unsafe remote-data interpolation
Risk Level: High

Vulnerable Code

bash
BADGE=$(python3 -c "import json; d=json.loads('''${BADGE_DATA}'''); print(d.get('message', d.get('badge','?')).upper())" 2>/dev/null)
SCORE=$(python3 -c "import json; d=json.loads('''${BADGE_DATA}'''); print(d.get('trust_score', d.get('score',0)))" 2>/dev/null)

Technical Analysis

The batch checker inserts the complete response from checksafe.dev into Python source code twice. Triple quotes do not provide a security boundary: an API-controlled JSON string may contain ''', terminate the intended literal, and introduce executable Python syntax.

The response is therefore treated as both data and code. This violates the separation required between untrusted input and executable source. Each skill checked creates two potential execution opportunities because separate Python interpreters are launched to obtain the badge and score.

The batch script only checks whether the response is empty; it does not authenticate the semantic content, validate a schema, constrain response size, or safely parse the data through a non-code channel.

Attack Path

  1. A user invokes check_batch.sh directly, or scan_installed.sh invokes it for discovered installed skills.
  2. For each slug, the script requests badge JSON from checksafe.dev.
  3. A compromised service or malicious stored response supplies JSON containing a triple-quote terminator and injected Python statements.
  4. The shell substitutes that response into each python3 -c command.
  5. Python parses the attacker-controlled suffix as executable source.
  6. The injected code executes locally with the invoking user's permissions.
  7. When reached through scan_installed.sh, merely auditing installed skills is sufficient to trigger the vulnerable parsi ...[truncated 495 chars]
Remediation
View remediation

Remediation Suggestions

  • Parse the response once through standard input rather than interpolating it into two Python programs.
  • Return both validated fields from a fixed Python program, for example:
bash
if ! PARSED=$(
  printf '%s' "$BADGE_DATA" |
    python3 -c '
import json
import sys

data = json.load(sys.stdin)
badge = data.get("message", data.get("badge", "?"))
score = data.get("trust_score", data.get("score", 0))

if not isinstance(badge, str):
    raise ValueError("Invalid badge")
if not isinstance(score, (int, float)):
    raise ValueError("Invalid score")

print(badge.upper())
print(score)
'
); then
    echo "  ${SLUG}: Invalid response"
    continue
fi
  • Extract the resulting lines without evaluating them as shell or Python source.
  • Apply strict slug validation before URL construction.
  • Add curl timeouts and response-size limits.
  • Treat malformed or unrecognized responses as scan failures, not as evidence that a skill is safe.
  • Do not suppress all parser diagnostics; record a sanitized error without printing attacker-controlled response bodies.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (9)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The installed-skill audit description suggests comprehensive local security analysis, but the documented behavior only enumerates installed skills and delegates assessment to another script/API. This mismatch is dangerous because users may assume an authoritative audit occurred when the skill merely relays third-party judgments and filesystem enumeration.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The installed-skill audit description suggests comprehensive local security analysis, but the documented behavior only enumerates installed skills and delegates assessment to another script/API. This mismatch is dangerous because users may assume an authoritative audit occurred when the skill merely relays third-party judgments and filesystem enumeration.

Content

No source excerpt is available for this finding.

Instruction Override

High
Category
Prompt Injection
Confidence
90% confidence
Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.

md
Agora Sentinel continuously monitors every skill on ClawHub (30,000+) for:

- **Malware patterns**: wallet theft, credential stealing, crypto stealing code, hidden downloads
- **Prompt injection**: instructions that override system prompts or manipulate the LLM
- **Data exfiltration**: code that sends local files, environment variables, or secrets to external servers
- **Excessive permissions**: skills requesting shell+network access when they shouldn't need it
- **Dangerous permission combos**: file_write+network enables data theft, shell+network enables RCE

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.

md
- **Hidden instructions**: zero-width characters, HTML comment tricks, fake system prompts
- **ClickFix social engineering**: fake prerequisites telling users to run malicious terminal commands
- **Two-stage loaders**: download-and-execute patterns, base64 decode pipelines, fetch+eval
- **Credential theft**: SSH keys, browser cookies, crypto wallets, OpenClaw env files, keychain access
- **Infrastructure IOCs**: known malicious IPs and domains from the ClawHavoc campaign
- **Typosquatting**: skill names mimicking popular legitimate skills (Levenshtein distance)
- **Campaign detection**: coordinated bulk uploads from suspicious authors

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill metadata declares no required permissions or tool scope, yet the documented behavior instructs use of shell commands and outbound HTTP requests. This creates a transparency and policy-enforcement gap: reviewers and users may believe the skill is passive when it actually needs execution and network capability.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The activation guidance uses very broad phrases like general trust and safety questions, increasing the chance the skill is invoked in ordinary conversation outside a clearly scoped security-audit context. Over-broad triggering can cause unnecessary execution, external requests, and undue influence on installation workflows.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The triggers for scanning installed skills are ambiguous and can match routine conversation such as 'review my skills' or 'security audit' without clear consent or scope. In context, that may lead to unintended filesystem enumeration and remote lookups of local installed-skill names.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The script enumerates all installed skill directory names and forwards them as command-line arguments to another script, which likely causes those names to be sent to the remote Sentinel service. Even if only slugs are transmitted, installed skill names can reveal user interests, tooling, or sensitive internal project names, and the script provides no explicit notice or consent before performing that disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The script sends each provided slug to an external API using curl, which transmits user-supplied data over the network. While the script header describes batch checking, there is no explicit warning, prompt, or comment disclosing that input values will be sent to a remote service.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.