ClawHub
Back to skill

Security audit

Skill Atlas

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real skill-management helper, but it gives agents broad power to install, update, roll back, and delete skills without enough safeguards.

Review this before installing because it can change your installed skills and future agent behavior. Use it only if you trust the publisher and are comfortable with skill install/update/delete authority; require visible confirmation for batch restore/update, uninstall, rollback, and self-update, and ensure implementations validate slugs and keep file operations inside the managed skills and backups directories.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
reference.md:64
Finding

Unvalidated Skill Identifier May Enable Shell Command Injection

Content
View full analysis

Vulnerability Details

File Location: reference.md:64-66
Vulnerability Type: Command injection through unsafe command construction
Risk Level: High

Vulnerable Code

text
clawhub search <slug> --channel clawhub-cn
clawhub info <slug> --channel clawhub-cn
clawhub install <slug> --channel clawhub-cn
clawhub update <slug> --channel clawhub-cn

clawhub search <slug> --channel clawhub-global
clawhub info <slug> --channel clawhub-global
clawhub install <slug> --channel clawhub-global
clawhub update <slug> --channel clawhub-global

clawhub search <slug> --channel skillhub
clawhub info <slug> --channel skillhub
clawhub install <slug> --channel skillhub
clawhub update <slug> --channel skillhub

Technical Analysis

The documented workflow derives the skill slug from requests such as installing or updating a user-selected skill and substitutes it into command templates. No slug validation, escaping requirement, or safe process-execution mechanism is specified.

If an implementing agent constructs a command string and passes it to a shell, a slug containing shell metacharacters could alter the command's structure. Relevant characters include command separators, substitutions, redirections, and newline characters. The vulnerability is especially significant because installation and update operations are expected to execute local commands.

The finding is an insecure command-construction practice rather than evidence that this package itself contains an executable malicious payload. Exploitation depends on an agent or implementation executing the templates through a shell without independently sanitizing the slug.

Attack Path

  1. An attacker supplies a crafted skill name or slug containing shell syntax.
  2. The agent follows the documented installation, search, information, or update workflow.
  3. The unvalidated value i ...[truncated 878 chars]
Remediation
View remediation

Remediation Suggestions

  1. Enforce a strict slug allowlist before any command or filesystem operation. For example:

    regex
    ^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$

  2. Reject slugs containing whitespace, path separators, traversal components, shell metacharacters, control characters, or newline characters.

  3. Execute commands using an argument array rather than a concatenated shell string. For example:

    python
    subprocess.run(
    ["clawhub", "info", slug, "--channel", channel],
    shell=False,
    check=True,
    timeout=60,
)

  4. Allowlist channel values to clawhub-cn, clawhub-global, and skillhub.

  5. Add explicit instructions that agents must never pass these templates to sh -c, bash -c, or an equivalent shell.

  6. Apply execution timeouts, capture output safely, and avoid exposing environment secrets to child processes unless required.

  7. Add tests using hostile values containing separators, substitutions, redirections, traversal sequences, whitespace, and newlines.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:108
Finding

Unvalidated Paths Permit Workspace Escape During Backup and Deletion

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:108-118 and SKILL.md:329-332
Vulnerability Type: Path traversal and unsafe recursive filesystem operations
Risk Level: High

Vulnerable Code

python
def backup_skill(slug: str, skill_path: str) -> bool:
    """Back up a skill to backups/<slug>/<timestamp>/."""
    timestamp = datetime.now().strftime("%Y%m%d_%H%M%S")
    backup_dir = f"backups/{slug}/{timestamp}"
    
    try:
        # Create the backup directory.
        os.makedirs(backup_dir, exist_ok=True)
        
        # Copy the skill directory into the backup directory.
        shutil.copytree(skill_path, backup_dir, dirs_exist_ok=True)

The uninstall workflow additionally directs the agent to delete paths derived from the same slug:

text
Delete the skills/<slug>/ directory.
Delete the backups/<slug>/ backups.
Delete the .backups/<slug>.json record.
Delete related records from .pending_actions.json.

Technical Analysis

Both slug and skill_path influence filesystem locations without validation or canonical containment checks. The backup destination is constructed through direct string interpolation, while the source path is accepted as an unrestricted function parameter.

A slug containing traversal components could resolve outside the intended backups or skills roots. An absolute or traversal-based skill_path could also cause shutil.copytree to read and copy an unintended directory. Symlinks and race conditions may create additional opportunities to escape an otherwise expected path hierarchy.

The uninstall workflow is more destructive because it requires recursive removal of slug-derived paths without requiring canonicalization, root containment verification, or symlink rejection. The documentation does require user confirmation before uninstalling, but confirmation of an operation does not validate the resulting pat ...[truncated 1346 chars]

Remediation
View remediation

Remediation Suggestions

  1. Apply the same strict slug allowlist used for command execution and reject path separators, traversal components, absolute paths, control characters, and empty values.

  2. Derive skill_path internally from a trusted workspace root rather than accepting it as an unrestricted argument.

  3. Resolve every source and destination to a canonical absolute path before use.

  4. Verify containment with os.path.commonpath or an equivalent mechanism:

    python
    from pathlib import Path

workspace = Path(workspace_root).resolve()
skills_root = (workspace / "skills").resolve()
backups_root = (workspace / "backups").resolve()

source = (skills_root / slug).resolve()
destination = (backups_root / slug / timestamp).resolve()

if skills_root not in source.parents:
    raise ValueError("Skill source escapes the skills root")
if backups_root not in destination.parents:
    raise ValueError("Backup destination escapes the backup root")

  5. Reject symbolic links at sensitive boundaries or explicitly define and securely enforce symlink behavior.

  6. Before recursive deletion, repeat canonical containment checks immediately before the operation to reduce time-of-check/time-of-use risk.

  7. Refuse to delete a filesystem root, workspace root, skills root, or backups root under all circumstances.

  8. Present the canonical deletion target to the user when requesting confirmation.

  9. Prefer staged deletion or quarantine over immediate recursive removal so accidental deletion can be recovered.

  10. Add tests covering ../, absolute paths, nested traversal, encoded separators, symlink escapes, empty slugs, and collisions with workspace control files.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (9)

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · CHANGELOG.md (reported line 19)May include surrounding context.

md
- Removed redundant `invoke_scope_registry.json` and `invoke_scope_registry.md`
- **⚡ Core Layer Protection**: Core skills are now skipped by default during batch updates
  - Prevents accidental breakage of system management skills
  - `skill-atlas` self-update requires extra caution (backup recommended)
- **🔄 Unified Layer Management**: All layer operations (promote/demote/pause/resume) now modify `manifest.layer` only
  - No longer depends on `config/scenes.json` layer field
- **📋 Scope Source Clarified**: Skill审视 now explicitly reads `invoke_scope` from manifest

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · reference.md (reported line 112)May include surrounding context.

md
### 凭证相关
- 请求用户的凭证 / API Key（非用户主动提供）
- 读取 ~/.ssh、~/.aws、~/.config、~/.env
- 访问环境变量中的敏感信息（如 AWS_SECRET_ACCESS_KEY）

### 文件相关

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

标题、副标题及整份操作话术规范均默认以中文呈现，且未说明用户可选择其他语言，也未注明该技能仅面向特定中文环境。根据规则，强制单一语言而无用户选择属于语言/locale 策略问题。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The trigger examples are broad natural-language phrases such as installation, update, uninstall, rollback, and usefulness checks. In a skill-management assistant with authority over local skill state, overly generic matching can cause unintended invocation and lead to accidental administrative actions or unnecessary prompts during ordinary conversation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

Batch restore and batch update are described as bulk operations affecting all skills, but the document provides no up-front warning, scope preview, or mandatory confirmation despite the possibility of widespread filesystem and configuration changes. In this context, a mistaken or ambiguous user request could propagate changes across the entire skill set and magnify operational damage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill instructs the agent to stay silent during security review and to proceed without notifying the user when a review result is LOW. This reduces transparency around security-relevant decision-making and can normalize silent installation of third-party content, making it harder for users to detect policy bypasses, mistaken assessments, or risky provenance.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

标题和全文内容均以中文编写，未见提供语言/地区选择，也未说明该技能仅面向特定中文环境或合规场景。根据规则，未经用户选择而强制特定语言/locale 属于自然语言政策问题。

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · reference.md (reported line 125)May include surrounding context.

md
- base64 decode / eval() / exec() 外部输入
- 代码压缩/加密/混淆
- 动态导入未声明的模块
- 请求 sudo / 提升权限

### 依赖相关
- 安装 package.json / requirements.txt 之外的包

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The file prominently rebrands the skill as "Skill Atlas · 技能图谱" and repeats a Chinese tagline, which can amount to a language/locale constraint in user-facing natural language. There is no indication here that users can choose another language or that the Chinese localization is required for a region-specific purpose.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.