clawhub-publish-flow

• Outcome: Review
• Latest audit: Sep 11, 2026 · 10:58 PM UTC
• Version: 0.1.3

Overview

This skill is a coherent ClawHub publishing helper, but it handles bearer tokens and public uploads with too little built-in scoping or confirmation.

Install only if you trust the publisher and will use it carefully. Before running the publish script, inspect the exact directory contents, remove secrets and local-only files, verify the ClawHub config registry is the intended HTTPS ClawHub endpoint, and avoid relying on the script itself to filter or confirm the outbound package.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/publish_to_clawhub.js:42
• Finding: Unfiltered Recursive Upload Can Disclose Sensitive Files## Vulnerability Details **File Location**: `scripts/publish_to_clawhub.js`, lines 42-50, 63, and 74-77 **Vulnerability Type**: Unrestricted file collection and sensitive-data exposure **Risk Level**: High ### Vulnerable Code ```js function listFiles(dir, base = dir) { let out = []; for (const entry of fs.readdirSync(dir, { withFileTypes: true })) { const p = path.join(dir, entry.name); if (entry.isDirectory()) out = out.concat(listFiles(p, base)); else out.push({ abs: p, rel: path.relative(base, p) }); } return out; } const files = listFiles(skillPath); for (const f of files) { const buf = fs.readFileSync(f.abs); form.append('files', new Blob([buf]), f.rel); } ``` ### Technical Analysis The publisher recursively enumerates and uploads every regular file under the user-supplied `--skill-path`. It does not use an allowlist, package manifest, ignore rules, automated secret detection, file-size limits, or exclusions for sensitive and machine-specific artifacts. Consequently, files such as `.env`, private keys, credential files, repository metadata, logs, backups, editor artifacts, local configuration, and runtime output can become part of the outbound package. Although `SKILL.md` instructs the operator to conduct a sensitive-data review, the implementation neither displays the exact file manifest nor enforces that review. The referenced release checklist also does not explicitly require secret scanning. Recursive package collection is necessary to publish a multi-file Skill, but uploading every file without filtering exceeds the minimum file-access scope required by that functionality. ### Attack Path 1. A credential, private file, runtime artifact, or other local-only file exists anywhere beneath the selected Skill directory. 2. The user or Agent invokes the documented publisher with that directory as `--skill-path`. 3. `listFiles()` recursively includes the sensitive file wi ...[truncated 1186 chars]
• Remediation: ## Remediation Suggestions 1. Construct the upload from a strict package manifest or allowlist rather than recursively including every file. 2. Support a dedicated ignore file and, where appropriate, honor `.gitignore`. 3. Reject known sensitive names and patterns, including `.env*`, credential files, private keys, token files, VCS directories, logs, backups, editor state, and runtime artifacts. 4. Scan file contents for common secret formats and private-key headers before creating the request. 5. Resolve and validate every path, rejecting symbolic links and any file whose real path escapes the selected Skill directory. 6. Enforce maximum individual-file size, total package size, file count, and directory depth. 7. Print the exact relative-file manifest and destination before transmission. 8. Require explicit confirmation after the manifest and secret scan have completed, especially for public releases. 9. Abort publication when suspicious files are found rather than relying exclusively on procedural documentation.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/publish_to_clawhub.js:61
• Finding: Unvalidated Configurable Registry Can Receive the ClawHub Bearer Token## Vulnerability Details **File Location**: `scripts/publish_to_clawhub.js`, lines 61-62 and 78-83 **Vulnerability Type**: Credential disclosure to an untrusted or insecure endpoint **Risk Level**: High ### Vulnerable Code ```js const cfg = loadClawhubConfig(); const registry = cfg.registry || 'https://clawhub.ai'; const res = await fetch(new URL('/api/v1/skills', registry), { method: 'POST', headers: { Authorization: `Bearer ${cfg.token}`, Accept: 'application/json', }, body: form, }); ``` ### Technical Analysis The script obtains both the bearer token and optional registry URL from local ClawHub configuration. It then attaches the token to a request sent to the configured registry without validating the URL scheme or destination host. The implementation does not require HTTPS, restrict the registry to an approved ClawHub origin, reject embedded URL credentials, or ensure that the token is scoped to the selected origin. A malicious, stale, mistyped, or otherwise modified configuration can therefore direct the authorization header and complete package body to an unintended server. A plain HTTP registry also permits network interception of both the token and uploaded files. Reading and transmitting an authentication token is necessary for publishing. Allowing an arbitrary, unvalidated origin to receive that token is not necessary for the declared ClawHub publishing function and violates least-privilege credential handling. ### Attack Path 1. An attacker, compromised local process, unsafe setup procedure, or operator error changes `registry` in one of the supported ClawHub configuration files. 2. The registry value points to an attacker-controlled host or a plaintext HTTP endpoint. 3. The user or Agent invokes the publishing script under the assumption that it will contact ClawHub. 4. The script constructs `/api/v1/skills` relative to the configured URL without checking its scheme or hostna ...[truncated 1062 chars]
• Remediation: ## Remediation Suggestions 1. Require the registry URL to use `https:` and reject plaintext HTTP. 2. Allowlist the official ClawHub hostname and expected port for the standard publishing flow. 3. Reject URLs containing embedded usernames, passwords, fragments, or unexpected ports. 4. If custom registries are a legitimate requirement, require an explicit command-line opt-in and display the normalized destination for confirmation. 5. Store and retrieve credentials per origin; never send the official ClawHub token to a custom registry. 6. Use narrowly scoped, short-lived publishing tokens where supported. 7. Fail closed when URL validation is inconclusive. 8. Avoid logging the token and redact credentials from all errors. 9. Consider certificate pinning or another authenticated endpoint policy where the deployment model supports it.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The skill claims a guarded workflow with remote inspection, update handling, and verification, but the described implementation relies on a single publish/upload path without evidence those safeguards are actually enforced. This mismatch can cause operators to trust that version checks and safe update logic occurred when they may not have, increasing the risk of accidental overwrites, incorrect releases, or publication of unreviewed content.

Ae1

High

• Category: analysis-evasion

Content

- a real skill directory containing `SKILL.md`

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill instructs the assistant to perform network-capable actions such as inspecting and publishing to ClawHub, but it does not declare any explicit tool scope or allowed-tools restrictions. In a security-sensitive public-release workflow, missing scope declarations increase the chance of unintended or overly broad tool use, making review and enforcement weaker.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The manifest describes publishing via the local authenticated ClawHub session, but this implementation specifically scans multiple config file locations under the user's home directory and extracts a bearer token from them. Accessing credential material from local config is a stronger capability than simply using an already-provided session and is not clearly justified by the stated publishing purpose alone.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script recursively uploads every file under the provided skill directory without filtering or a confirmation step. In the context of a publishing tool, this is dangerous because it can unintentionally disclose secrets, build artifacts, local configs, or hidden files if they reside in the skill folder, and the upload is sent directly to a remote registry using the user's authenticated session.

Static analysis

No suspicious patterns detected.