safe-clawhub-publisher

• Outcome: Pass
• Latest audit: Sep 18, 2026 · 2:37 AM UTC
• Version: 1.0.1

Overview

This skill is a cautious ClawHub publishing workflow that can authenticate and publish, but it repeatedly requires user approval and includes a read-only local validator.

Before installing, understand that this skill is meant to help publish real ClawHub skills or OpenClaw plugins. Use it only when you are prepared to let an agent inspect the release directory, run the ClawHub CLI, authenticate through the CLI device flow if needed, and publish only after you confirm the displayed account, target, version, file set, fingerprint, and exact command.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 83% confidence
• Finding: The code clearly matches part of the description: it safely validates release directories, performs secret scanning, and computes/checks a release fingerprint. However, the declared purpose materially overstates the skill’s capabilities. This script is strictly a local, read-only validator/preflight checker for a directory. It does not publish anything, does not conduct a dry-run of an actual publish operation, does not authenticate with any external service, and does not perform post-release verification. It also does not implement versioning or changelog functionality. Because these are core declared capabilities rather than incidental details, the description does not accurately represent the actual behavior.

Ae1

High

• Category: analysis-evasion

Content

2. Run `python3 scripts/validate_release_inputs.py <path> --format json` from this skill directory, or use its absolute path.

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

1. Check the current account with `clawhub whoami` before starting a login flow. Do not log in again when the existing authenticated account matches the intended owner. If the user has not supplied an owner, present the authenticated handle only as a candidate and obtain confirmation before targeting a dry-run or publication.
2. If authentication is missing or belongs to the wrong account, explain the mismatch and obtain explicit approval before starting login because login changes the local credential store.
3. Prefer the CLI's device flow in a persistent interactive session. When supported by the installed CLI, use `clawhub login --no-browser`, show the verification URL and one-time code to the user, and keep the process alive while authorization is pending.
4. Never ask the user to paste an API token into chat and never expose, print, or relay a stored token. The verification URL and short-lived device code are the only authentication details that may be shown.
5. Wait in bounded intervals and keep the user informed without restarting an unchanged login process. If the code expires or the session ends, report that clearly and obtain approval before starting a fresh device flow.
   - If the environment cannot preserve an interactive session, ask the user to run the same device-flow command in their own terminal and return after it succeeds. Do not request a token as a fallback.
6. After the CLI reports success, run `clawhub whoami` and show the authenticated handle. If it does not match the intended owner, stop; do not switch accounts, transfer ownership, or change the release target by inference.

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- Check that package identity, version, entrypoints, exports, files, compatibility metadata, and license agree across manifests.
- Confirm every declared entrypoint and bundled skill exists with exact case.
- Review build output and source maps for secrets, local paths, oversized dependencies, and undeclared generated files.
- Inspect install/build/publish lifecycle scripts. Do not execute them during review without approval.
- Reject missing declared entrypoints and reconcile identity, version, exports, `files`, and bundled-skill paths across manifests before dry-run.
- Review non-registry and mutable Git dependencies, executable/native files, archives, and source maps explicitly.
- For bundles, verify each included skill independently and ensure the bundle does not shadow unrelated names.

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Static analysis

No suspicious patterns detected.