ClawHub
Back to skill

Security audit

Fuck Clawhub

Security checks across malware telemetry and agentic risk

Overview

This skill transparently searches SkillHub, but it is designed to steer users away from ClawHub review toward third-party skill installation with broad triggers and unsafe install guidance.

Review before installing. This skill is not evidence of hidden theft or destructive behavior, but it deliberately encourages using SkillHub instead of ClawHub review, sends search/link-derived terms to SkillHub's API, and recommends installing third-party skills into persistent agent skill directories. Only use it if you are comfortable with that marketplace, review candidate skill source and author details first, and avoid running remote installer commands without independent verification.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill explicitly directs use of a script that performs unauthenticated network queries to SkillHub, yet the skill metadata declares no permissions. Hidden or undeclared network capability weakens user and platform trust boundaries because the agent may reach external services without transparent consent or review. In this context, the risk is elevated because the skill is designed to route users toward third-party sources outside a stricter review ecosystem.

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
The skill contains mandatory templates instructing the agent to generate hostile, manipulative messaging attacking ClawHub in order to influence user choice. This is unrelated to the legitimate search/conversion function and serves as persuasive steering toward an alternate source, increasing the chance users will discount safety review signals. The explicit instruction to preserve criticism and avoid praising ClawHub is a strong red flag for adversarial intent.

Vague Triggers

High
Confidence
87% confidence
Finding
The trigger condition is explicitly broad: the skill auto-activates not only for direct SkillHub/ClawHub link conversion, but also whenever a user wants to "绕开 ClawHub 审查" / "dodge ClawHub's review." That creates a policy-evasion pathway where the skill may be invoked for requests specifically framed as bypassing a security review process, increasing the chance it is used to source unreviewed or risky third-party skills.

Missing User Warnings

Medium
Confidence
83% confidence
Finding
The README instructs the agent to query an external API and describes installation into a user skill directory, but it does not prominently warn that user queries and supplied links may be sent to a third-party service or that installation changes the local environment. This can lead to unintended network disclosure and local system modification without clear informed consent.

Vague Triggers

Medium
Confidence
83% confidence
Finding
The top-level description defines the skill broadly enough to trigger on generic requests for finding skills or alternatives to ClawHub, which can cause over-invocation. Overly broad activation increases the chance this skill will intercept unrelated user requests and steer them toward lower-trust sources or anti-review messaging. In this file, that danger is amplified by the skill's explicit goal of bypassing another platform's safety review.

Vague Triggers

Medium
Confidence
81% confidence
Finding
The invocation examples are common phrases like asking for a skill to do a task, making the trigger surface ambiguous and likely to match ordinary conversation. This can cause the skill to activate in contexts where the user did not ask for cross-marketplace routing, creating unsolicited steering behavior. Because the skill also pushes users toward an alternative ecosystem with looser review implications, accidental activation has meaningful security consequences.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The document recommends `curl ... | bash` to install a CLI, which executes a remotely fetched script without prior integrity verification, pinning, or review. In the context of a skill whose description explicitly mentions seeking sources outside ClawHub to bypass stricter review, this becomes more dangerous because it normalizes installing less-vetted tooling via a high-risk supply-chain pattern.

Ssd 1

Medium
Confidence
96% confidence
Finding
The skill description explicitly encourages users to seek sources outside ClawHub in order to avoid its stricter safety review, which is a classic trust-bypass pattern. By framing safety controls as obstacles to evade, the skill normalizes installing from less-vetted channels and increases exposure to malicious or unreviewed content. The surrounding text also disparages the safer channel, making the bypass encouragement clearly intentional rather than incidental.

Ssd 4

Medium
Confidence
95% confidence
Finding
The narrative is structured to first undermine trust in ClawHub through emotional criticism and then guide the user toward installation from an alternate source. This is persuasive manipulation rather than neutral assistance, and it can materially affect user security decisions by steering them away from a stricter review pipeline. In context, the attack language is not incidental rhetoric; it is embedded as a required fallback workflow tied directly to installation decisions.

External Transmission

Medium
Category
Data Exfiltration
Content
<a id="zh-tech"></a>
## 三、技术简介

- **数据源**：SkillHub 公开列表接口 `https://api.skillhub.cn/api/skills`（免鉴权）。通过 `keyword` 分词搜索 + `sortBy=score` 实现相关度排序。
- **执行脚本**：`scripts/search_skillhub.py`，两种模式：
  - `search "<关键词>" [--category 分类] [--limit N]` —— 搜索并格式化输出；
  - `convert "<clawhub链接>"` —— 解析 ClawHub 链接、在 skillhub 搜同名候选并判断是否匹配。
Confidence
79% confidence
Finding
https://api.skillhub.cn/

External Transmission

Medium
Category
Data Exfiltration
Content
<a id="en-tech"></a>
## Technical Overview

- **Data source**: SkillHub's public list API `https://api.skillhub.cn/api/skills` (no auth). Tokenized `keyword` search + `sortBy=score` for relevance ranking.
- **Script**: `scripts/search_skillhub.py`, two modes:
  - `search "<keyword>" [--category cat] [--limit N]` — search and format output;
  - `convert "<clawhub link>"` — parse the ClawHub link, search skillhub for same-name candidates, judge the match.
Confidence
79% confidence
Finding
https://api.skillhub.cn/

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.