Security audit

ClawHub 发布助手

Security checks for vulnerabilities and agentic risk

Overview

The skill is meant to publish local skills to ClawHub, but its broad activation language and shell-built publish command create avoidable risk of unintended account actions or command injection.

Install only if you intend to use this as a ClawHub publishing helper and are comfortable with it running ClawHub CLI commands under your account. Before publishing, verify the target directory, slug, version, changelog, tags, and displayed command arguments; avoid using untrusted skill metadata or changelog text unless the workflow is changed to pass arguments safely without shell interpolation.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:189
Finding: Shell Command Injection Through Untrusted Publishing Parameters
Content: View full analysis
\ --slug \ --name \ --version \ --changelog "" \ --tags "" ``` ### Technical Analysis The skill is allowed to use `ExecuteShellCommand` and instructs the agent to construct a command using values obtained from: - User responses, particularly the changelog and tags. - `SKILL.md` frontmatter. - The skill directory name and filesystem path. - Output returned by `clawhub inspect`. The command template does not require an argument-array execution API, strict validation, or context-appropriate shell escaping. The skill path, slug, display name, and version are shown without quoting. Although changelog and tags are enclosed in double quotes, double quotes do not prevent shell command substitution using `$(...)` or backticks. For example, a changelog containing the following value would remain executable when interpolate ...[truncated 1958 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.
md
- `SKILL.md` - 技能描述文件

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger examples include broad phrases like '发布技能', '上传技能', and 'publish', which can plausibly appear in ordinary conversation or meta-discussion rather than an explicit request to execute a publishing workflow. Because this skill has shell execution capability and can perform network-affecting publication actions, accidental invocation could lead to unintended login prompts, repository inspection, or even attempted publication of a local skill.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest trigger field contains ambiguous activation phrases including generic words like 'publish' and '上传技能', without scoping them to ClawHub or requiring explicit user intent. In an agent environment, such loose matching increases the chance that the skill activates during unrelated tasks and gains access to read/write/shell operations unnecessarily.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The invocation instructions say to 'immediately call this skill' when users say broad phrases such as '上传技能' or '技能发布', with no boundary checks or exclusions. Given the skill's ability to run shell commands including login and publish operations, immediate activation materially raises the risk of unintended execution and accidental remote publication or account interaction.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The description and operational instructions are entirely in Chinese and the trigger design assumes Chinese user phrasing, but there is no statement offering the user a language or locale choice. Under the policy, forcing a specific language without opt-in can be a natural-language policy issue unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.