Trending Skill Finder

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:46 PM UTC
• Version: 1.0.9

Overview

This skill coherently monitors ClawHub skill popularity, using disclosed network fetches and local state files without hidden execution or destructive behavior.

Install only if you are comfortable with the skill contacting clawhub.ai and creating local files under ~/.skill-surge-notifier for state, config, profile, and optional cron logs. Add the cron entry only if you want periodic background checks.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill advertises commands that require network access and environment-dependent behavior, but it does not declare any explicit tool scope or permissions boundary. In an agent ecosystem, this weakens least-privilege controls and can cause the skill to be granted broader execution capability than reviewers or users expect, especially since it fetches external data and honors environment-variable path overrides.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

• State is stored in ~/.skill-surge-notifier/state.json. The first run seeds the baseline; growth % appears from the second run onward.
• All output is printed to stdout. When used inside an agent, the agent must capture the CLI output to surface alerts in chat.
• To run automatically, add to crontab (crontab -e):

bash

0 */4 * * * node {baseDir}/cli.js check >> ~/.skill-surge-notifier/surge.log 2>&1

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The markdown states that data is stored locally in ~/.skill-surge-notifier/ and shows a cron job that appends to ~/.skill-surge-notifier/surge.log, but it does not explicitly warn users that using the skill will create and update files on disk. Because this file is the user-facing description, a brief disclosure about local writes would improve safety transparency.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The comment says the file can be run directly as the fetch command, but the subsequent condition checks whether the invoked script path ends with "fetch_trending.ts" even though this file is fetch_trending.js. That is an active contradiction between the inline documentation and the implemented direct-run gate.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The inline comment says this file is intended for direct execution via the check command, but the guard immediately below only runs when the invoked filename ends with "surge_check.ts". In this JavaScript file, that documented intent conflicts with the implemented condition and can prevent the advertised direct-run behavior.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: fetch_trending.js:21