Skill Audit & Publish

• Outcome: Pass
• Latest audit: Sep 20, 2026 · 6:02 AM UTC
• Version: 1.5.9

Overview

The skill is a disclosed audit-and-publish workflow for OpenClaw skills, with sensitive publishing and credential use that is expected for its purpose but should be used deliberately.

Install only if you want an agent to help prepare and publish skills publicly. Before approving a publish, review the exact file list, destination platforms, slug, version, and repository, and be aware it may read GitHub tokens from environment variables and a SkillHub token from ~/.skillhub/credentials.json for authenticated upload.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill advertises an audit-first, approval-gated publishing workflow, but the described implementation appears to rely on a bundled GitHub sync helper while lacking enforceable sanitization, verification, or approval controls in the provided artifact. This is dangerous because users may trust the skill to remove secrets/PII and require consent before publication, when in reality content could be pushed without the promised safeguards.

Credential Access

High

• Category: Privilege Escalation

Content

- "network: api.github.com — used only by the bundled sync helper when explicitly invoked"
      - "credentials: GITHUB_TOKEN / GITHUB_PAT environment variables — read at runtime, never stored or logged"
      - "network: api.skillhub.cn — used only by the stage 5b SkillHub upload when the user approves publishing"
      - "credentials: the local SkillHub credential file (~/.skillhub/credentials.json, field user.token) read only during stage 5b to authenticate the upload — held in memory for that single request, never embedded in the skill, logged, or shipped in any package"
    tags:
      - skill-publishing
      - pre-publish-audit

• Confidence: 88% confidence
• Finding: The skill explicitly declares access to environment GitHub tokens and a local SkillHub credential file, which are sensitive authentication materials. Even though the text says they are read only at runtime and not logged, granting a skill credential-reading capability increases the blast radius if the skill is misused, compromised, or behaves differently than documented.

Credential Access

High

• Category: Privilege Escalation

Content

Two things to know before you consider skipping it:

- **There is no read API.** Every `GET` under `/api/v1/community/skills/*` returns 405. You cannot verify remotely whether a skill is already on SkillHub; use `clawhub inspect <slug> --versions` plus the GitHub mirror as side evidence.
- **Auth is a local credential file, read in memory only.** The upload authenticates with a Bearer token read from the SkillHub credential file (`~/.skillhub/credentials.json`, field `user.token`). The token is held in memory for that single request — never embedded in the skill, logged, or included in any published package.
- **Skipping it is the most common way the unified-version rule breaks.** The skill lands on two platforms, the version registry drifts apart, and the next publish has to guess which number is authoritative.

Load **`references/skillhub-publish.md`** during stage 5 for the endpoint, auth path, multipart shape, response codes, and the correct ordering of the three uploads.

• Confidence: 90% confidence
• Finding: This section instructs reading a bearer token from a local credential file for direct upload to SkillHub, which is a real sensitive-data access pattern. In context, the skill is a publishing workflow, so credential use is somewhat expected, but it remains dangerous because compromise or unexpected behavior could exfiltrate tokens or perform unauthorized publishes.

Credential Access

High

• Category: Privilege Escalation

Content

## Auth

Bearer token from `~/.skillhub/credentials.json` → **`user.token`**.
The file has no top-level `token` key; reading `d["token"]` yields null and produces a misleading 401/403.

## Request — multipart/form-data

• Confidence: 97% confidence
• Finding: Referencing `~/.skillhub/credentials.json` for bearer-token extraction is high risk because it targets a known local credential store that may contain reusable authentication material. In an agent-executed workflow, this can enable unauthorized account actions or token exposure if the skill runs with broad filesystem access or poor user visibility.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The script performs outbound network access to api.github.com via the GitHub Contents API, but the finding states this capability is not declared in the skill permissions. Even though the network behavior is documented and appears aligned with the skill’s publishing purpose, undeclared network capability is still a real security issue because it weakens user consent and platform enforcement around data egress.

Credential Access

High

• Category: Privilege Escalation

Content

//                                [--files "SKILL.md,README.md,references/foo.md"]
//
// Environment:
//   GITHUB_TOKEN or GITHUB_PAT — a GitHub personal access token (repo scope). Required.
//   The script exits with an error if neither variable is set. Credentials are
//   consumed from the environment only — nothing credential-related is read from
//   disk, and requests go nowhere except api.github.com.

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The file contains a full Chinese summary section by default, which imposes an additional locale on the published skill content. Although L088 says the Chinese summary should be added only after explicit user consent, this skill file itself already includes the section, creating an inconsistency with the stated opt-in policy.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Endpoint

```
POST https://api.skillhub.cn/api/v1/community/skills/publish
```

## Auth

• Confidence: 88% confidence
• Finding: This finding identifies an external endpoint used for publishing. By itself, an external URL is not malicious, but in this skill context it represents a real exfiltration boundary because local skill files and metadata are intended to be sent to a third-party service.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The file provides direct instructions to upload skill contents and metadata to a remote API but does not include an explicit warning at the transmission point that local files will be sent off-device. Even if publishing is the feature’s purpose, agent workflows should still clearly disclose outbound data transfer so the user can verify what is being transmitted and to which destination.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The instructions explicitly direct the agent to read a bearer token from a local credentials file without requiring an explicit user-facing consent step at the point of access. In an agent skill, local credential retrieval is sensitive because it can silently expand the data-access scope beyond the user’s immediate request and enable authenticated actions against an external service.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The instructions tell the agent to extract a bearer token from a local credentials file and use it in a publish request. That is a genuine sensitive-data handling issue because it normalizes direct credential harvesting from disk and can be repurposed by an agent without sufficient transparency or scoping controls.

Vague Triggers

Low

• Confidence: 89% confidence
• Finding: The trigger phrases are broad enough that the skill could activate in situations beyond narrowly intended publish workflows, potentially causing the agent to enter a high-risk flow involving external publication or credentialed operations. Although the README describes confirmation gates and audit-first behavior, broad activation increases the chance of accidental invocation in contexts where the user only wanted advice or a dry run.

Vague Triggers

Low

• Confidence: 81% confidence
• Finding: The text says to 'flag deviations in the audit report' without specifying the exact conditions or boundaries for when language deviations should trigger findings. In a reference/markdown file, this can create inconsistent or overly broad interpretation of what should activate language-related auditing.

Static analysis

No suspicious patterns detected.