ClawHub
Back to skill

Security audit

Hot Skills

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently monitors public ClawHub skill metrics and stores local state/profile data, with no evidence of hidden exfiltration or destructive behavior.

Install only if you are comfortable with a Node script periodically contacting ClawHub and writing state, config, profile data, and optional logs under ~/.skill-surge-notifier or paths you configure. Do not put secrets or sensitive internal agent details in the profile text or keywords.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill advertises executable Node.js commands and uses environment variables plus network access, but it does not declare any explicit tool scope or permissions. This creates a capability-transparency gap: an agent or reviewer may invoke the skill without realizing it performs outbound network operations and reads environment-controlled paths, increasing the risk of unintended data exposure or policy bypass.

Session Persistence

Medium
Category
Rogue Agent
Content
- State is stored in `~/.skill-surge-notifier/state.json`. The first run seeds the baseline; growth % appears from the second run onward.
- All output is printed to stdout. When used inside an agent, the agent must capture the CLI output to surface alerts in chat.
- To run automatically, add to crontab (`crontab -e`):

```bash
0 */4 * * * node {baseDir}/cli.js check >> ~/.skill-surge-notifier/surge.log 2>&1
Confidence
85% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Low
Confidence
82% confidence
Finding
The markdown states that profile information is stored locally in `~/.skill-surge-notifier/`, and later suggests setting the profile using the agent's description and keywords. While this discloses storage location, it does not clearly warn users that potentially sensitive agent metadata will be persisted on disk.

Missing User Warnings

Low
Confidence
85% confidence
Finding
This code saves the user's agent description and keywords to a profile file via saveProfile, which is a file-write operation. Although the command name implies configuration, there is no explicit warning here that the provided text will be persisted locally before the write occurs.

Intent-Code Divergence

Low
Confidence
93% confidence
Finding
The inline comment says the file can be run directly via "npm run fetch", implying this module is the direct-run target, but the guard checks whether process.argv[1] ends with "fetch_trending.ts" while the analyzed file is "fetch_trending.js". This is an active contradiction between the code documentation and the actual execution condition.

Missing User Warnings

Low
Confidence
83% confidence
Finding
The code logs profile-influenced relevance results to stdout, including match terms, without any warning or consent flow. In shared terminals, CI logs, shell history capture, or centralized log collection, this can disclose a user's interests or profile-derived attributes to unintended viewers.

Intent-Code Divergence

Low
Confidence
97% confidence
Finding
The comment at L125 says this file can be run directly via the check command, implying the direct-run guard applies to this JavaScript file. However, the condition at L126 only executes when the invoked path ends with "surge_check.ts", so the documented direct-run behavior does not match what the code actually does.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
fetch_trending.js:21