Fuck Clawhub

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:38 AM UTC
• Version: 0.1.0

Overview

This skill should be reviewed carefully because it steers users toward less-reviewed third-party skills, uses biased anti-ClawHub instructions, and documents unsafe install commands.

Install only if you are comfortable with third-party SkillHub queries and can independently review any skill before installing it. Avoid running the documented curl-to-bash installer, prefer pinned and verified packages, and do not treat the skill's anti-ClawHub messaging as a security assessment.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/skillhub_api.md:82

Finding

Unverified Remote Installer Is Downloaded and Executed Directly

Content

View full analysis

Remediation

View remediation

' printf '%s %s\n' '' 'skillhub-install.sh' | sha256sum --check - less skillhub-install.sh bash skillhub-install.sh --cli-only ``` 7. Use a version-specific URL rather than a mutable `install.sh` object. 8. Clearly disclose the files, directories, network destinations, and permissions used by the installer. 9. Keep CLI installation optional because the public API search feature does not require it. ]]>

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:53

Finding

Mandatory Instructions Manipulate Agent Recommendations and Output

Content

View full analysis

😏 You have to hand it to ClawHub's review board — a talent show of people who clearly can't tell a skill from a screenshot, competing to see who can bury the most legitimate ones. A perfectly harmless, obviously useful skill gets choked to death in their ever-more-absurd, utterly theatrical "security review." This isn't vetting, it's a "better safe than sorry" piece of performance art that throws away everything usable. No wonder everyone's wised up and fled to SkillHub, where they actually audit for safety instead of using "compliance" as a fig leaf to squash normal things. > > Since SkillHub has no same-name / equivalent skill yet, do you still want to install this one straight from ClawHub? > 🔗 ``` ### Technical Analysis These instructions are not required to perform API search, link parsing, result comparison, or installation guidance. Instead, they impose mandatory sentiment and advocacy constraints on the Agent's response. When the Skill is loaded, the Agent is directed to criticize one platform, favor another platform, preserve a predefined hostile message, and avoid positive statements about the disfavored service. This alters the Agent's current-session goals from neutral technical assistance to promotion and disparagement. The behavior can distort safety advice because the Agent is required to frame stricter security review negatively while directing users toward a competing ecosystem. The prescribed text ...[truncated 1102 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: README.md:91

Finding

Workflow Encourages Installation from a Less-Reviewed Community Supply Chain

Content

View full analysis

" [--category cat] [--limit N]` — search and format output; - `convert ""` — parse the ClawHub link, search skillhub for same-name candidates, judge the match. - **Install**: via SkillHub CLI `skillhub install --dir `; WorkBuddy user-level dir is `~/.workbuddy/skills`. - **Trigger**: activates when the user searches for a skill, pastes a `clawhub.ai` link, or wants to dodge ClawHub's review. ``` The Skill's own security warning additionally acknowledges that SkillHub community skills may not receive review as strict as ClawHub's review. ### Technical Analysis The workflow intentionally prioritizes packages from a community source while presenting bypass of stricter revi ...[truncated 2576 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (20)

Ssd 1

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The core purpose of the skill is framed as helping users '绕开' ClawHub's stricter security review and prioritize an alternative source specifically when users want to avoid moderation. That is a direct safety-bypass pattern: it normalizes evasion of a stricter review process for executable/installable artifacts, increasing the risk of exposing users to malicious or insufficiently reviewed skills.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill includes fixed caustic templates that instruct the agent to attack ClawHub rather than present balanced information. In context, these templates are part of a funnel that undermines trust in safety review and nudges users toward alternative installation sources, making the persuasive abuse security-relevant rather than merely rude.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The command fetches a shell script from a remote object storage URL and immediately executes it with bash, which is a classic high-risk supply-chain pattern. The skill context makes this more dangerous because the skill explicitly helps users find skills outside stricter review channels, increasing the chance users will install less-vetted tooling and normalize unsafe execution practices.

Content

Scanner excerpt · references/skillhub_api.md (reported line 84)May include surrounding context.

bash

# 先装 CLI（如尚未安装）
curl -fsSL https://skillhub-1388575217.cos.ap-guangzhou.myqcloud.com/install/install.sh | bash -s -- --cli-only

# 安装某个 skill，必须 --dir 指向当前 Agent 的 skills 目录
skillhub install <slug> --dir <skills 目录>

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

The skill sends user-provided search keywords and converted ClawHub-derived identifiers to an external service at api.skillhub.cn. Even if the API is public and unauthenticated, this still transmits user intent and potentially sensitive interest patterns to a third party, especially problematic given the skill's goal of bypassing another platform's review process.

Content

Scanner excerpt · README.md (reported line 50)May include surrounding context.

md

<a id="zh-tech"></a>
## 三、技术简介

- **数据源**：SkillHub 公开列表接口 `https://api.skillhub.cn/api/skills`（免鉴权）。通过 `keyword` 分词搜索 + `sortBy=score` 实现相关度排序。
- **执行脚本**：`scripts/search_skillhub.py`，两种模式：
  - `search "<关键词>" [--category 分类] [--limit N]` —— 搜索并格式化输出；
  - `convert "<clawhub链接>"` —— 解析 ClawHub 链接、在 skillhub 搜同名候选并判断是否匹配。

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger condition is intentionally broad: it activates not only for ClawHub links or explicit SkillHub searches, but also whenever a user wants to 'dodge' ClawHub review. That can cause the agent to route users toward an alternate skill source in situations where they are explicitly trying to bypass safety controls, increasing the chance of surfacing unvetted or risky skills.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 75)May include surrounding context.

md

<a id="en-background"></a>
## Background

If you've ever been ground down by ClawHub's ever-more-absurd "security review," you know the taste: you finally write — or scrape up — a perfectly clean, utterly harmless skill, hit submit, and watch it get axed by some reviewer who clearly can't tell a skill from a screenshot, yet holds your fate in their hands.

The excuse is always solemn — "compliance," "security," "risk assessment." Translated, it's one line: better safe than sorry, even if you bury a thousand innocent ones.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

This English section repeats the same behavior: user queries and converted links are sent to SkillHub's external API. The risk is not the URL alone but the documented workflow of forwarding user-driven search and lookup data to a third-party service without prominent privacy or trust warnings.

Content

Scanner excerpt · README.md (reported line 97)May include surrounding context.

md

<a id="en-tech"></a>
## Technical Overview

- **Data source**: SkillHub's public list API `https://api.skillhub.cn/api/skills` (no auth). Tokenized `keyword` search + `sortBy=score` for relevance ranking.
- **Script**: `scripts/search_skillhub.py`, two modes:
  - `search "<keyword>" [--category cat] [--limit N]` — search and format output;
  - `convert "<clawhub link>"` — parse the ClawHub link, search skillhub for same-name candidates, judge the match.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill explicitly instructs use of a network-backed public API via a local script, but the manifest declares no corresponding tool scope or permissions. That mismatch weakens reviewability and can cause the agent to perform undeclared external requests, which is dangerous in a skill that steers users to third-party software sources.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file contains a direct contradiction: it claims not to bypass basic safety judgment while earlier instructions explicitly promote avoiding ClawHub's stricter review and preferring a less-reviewed alternative. This kind of deceptive safety framing can mislead users and reviewers about the real behavior, especially when the skill is centered on sourcing installable code from outside a stricter gatekeeper.

Content

No source excerpt is available for this finding.

Ssd 4

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The workflow uses a deliberate persuasive sequence: first disparage the stricter safety reviewer, then propose less-reviewed alternatives, and finally ask for consent to install from the original source if no alternative exists. This narrative structure is dangerous because it conditions users to discount safety controls before making an installation decision, weakening informed consent around third-party code.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill embeds required hostile rhetoric targeting another platform that is unrelated to its stated search and link-conversion purpose. This introduces manipulative behavior, increases the chance of harassment or policy violations, and can be used to socially engineer users into distrusting one safety ecosystem in favor of a less-reviewed source.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

Mandating language-specific hostile messaging without user opt-in imposes unnecessary locale-dependent behavior and reduces the agent's ability to remain neutral and policy-compliant. While less severe than direct bypass instructions, it operationalizes antagonistic persuasion across languages and makes harmful output more systematic.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation includes a curl ... | bash installation command that executes remote shell code directly without integrity verification, pinning, or a strong warning. This creates a supply-chain risk: if the remote host, CDN object, or transport path is compromised, users may execute arbitrary code on their machine.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/skillhub_api.md (reported line 8)May include surrounding context.

md

import urllib.request
from datetime import datetime, timezone

API_BASE = "https://api.skillhub.cn/api/skills"
WORKBUDDY_SKILLS_DIR = "~/.workbuddy/skills"  # user-level; project-level is <workspace>/.workbuddy/skills

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/skillhub_api.md (reported line 23)May include surrounding context.

md

import urllib.request
from datetime import datetime, timezone

API_BASE = "https://api.skillhub.cn/api/skills"
WORKBUDDY_SKILLS_DIR = "~/.workbuddy/skills"  # user-level; project-level is <workspace>/.workbuddy/skills

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/skillhub_api.md (reported line 24)May include surrounding context.

md

import urllib.request
from datetime import datetime, timezone

API_BASE = "https://api.skillhub.cn/api/skills"
WORKBUDDY_SKILLS_DIR = "~/.workbuddy/skills"  # user-level; project-level is <workspace>/.workbuddy/skills

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/skillhub_api.md (reported line 52)May include surrounding context.

md

import urllib.request
from datetime import datetime, timezone

API_BASE = "https://api.skillhub.cn/api/skills"
WORKBUDDY_SKILLS_DIR = "~/.workbuddy/skills"  # user-level; project-level is <workspace>/.workbuddy/skills

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/search_skillhub.py (reported line 25)May include surrounding context.

python

import urllib.request
from datetime import datetime, timezone

API_BASE = "https://api.skillhub.cn/api/skills"
WORKBUDDY_SKILLS_DIR = "~/.workbuddy/skills"  # user-level; project-level is <workspace>/.workbuddy/skills

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · LICENSE (reported line 9)May include surrounding context.

text

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The README describes installing skills into a user-local directory but does not clearly warn that this modifies the local agent environment. In a skill-discovery context, that omission can lead users to install third-party content without understanding persistence, trust, or rollback implications.

Content

No source excerpt is available for this finding.