Security audit
Security checks for vulnerabilities and agentic risk
ClawScan rates this publishing skill suspicious because it reports instructions that may overwrite original files and expand publishing beyond the requested destination; some scanner coverage was partial.
Consider the reported possibility of publishing to additional platforms and overwriting original files before installing. The scan is incomplete: it covered 7 of 9 components, and some checks were partial because of obfuscated instruction text, opaque content, and unresolved references. The suspicious verdict indicates reported security weaknesses; it does not establish malicious intent.
scripts/sync_skill_to_github.jsGitHub publishing helper performs remote writes without an enforced approval gate
Premature invocation can publish unapproved local contents or overwrite existing repository files on the selected branch.
SKILL.mdMandatory three-platform workflow expands a ClawHub-only publishing request
The approved package can be uploaded to an unrequested platform, creating an unauthorized publication under the user's SkillHub identity.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- "network: api.github.com — used only by the bundled sync helper when explicitly invoked"
- "credentials: GITHUB_TOKEN / GITHUB_PAT environment variables — read at runtime, never stored or logged"
- "network: api.skillhub.cn — used only by the stage 5b SkillHub upload when the user approves publishing"
- "credentials: the local SkillHub credential file (~/.skillhub/credentials.json, field user.token) read only during stage 5b to authenticate the upload — held in memory for that single request, never embedded in the skill, logged, or shipped in any package"
tags:
- skill-publishing
- pre-publish-audit
The post-publish instruction explicitly copies the transformed staging package over the original skill directory, contradicting repeated promises that original files remain untouched. An agent following it could overwrite private, richer source material or unpublished local changes with a sanitized public version.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Two things to know before you consider skipping it:
- **There is no read API.** Every `GET` under `/api/v1/community/skills/*` returns 405. You cannot verify remotely whether a skill is already on SkillHub; use `clawhub inspect <slug> --versions` plus the GitHub mirror as side evidence.
- **Auth is a local credential file, read in memory only.** The upload authenticates with a Bearer token read from the SkillHub credential file (`~/.skillhub/credentials.json`, field `user.token`). The token is held in memory for that single request — never embedded in the skill, logged, or included in any published package.
- **Skipping it is the most common way the unified-version rule breaks.** The skill lands on two platforms, the version registry drifts apart, and the next publish has to guess which number is authoritative.
Load **`references/skillhub-publish.md`** during stage 5 for the endpoint, auth path, multipart shape, response codes, and the correct ordering of the three uploads.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
## Auth
Bearer token from `~/.skillhub/credentials.json` → **`user.token`**.
The file has no top-level `token` key; reading `d["token"]` yields null and produces a misleading 401/403.
## Request — multipart/form-data
The skill uses 'network' capability that is not covered by the declared 'allowed-tools' preapproval. Review the host runtime's actual enforcement policy; runtime permissions are unknown unless separately verified, and this declaration alone does not establish a permission ceiling.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
// [--files "SKILL.md,README.md,references/foo.md"]
//
// Environment:
// GITHUB_TOKEN or GITHUB_PAT — a GitHub personal access token (repo scope). Required.
// The script exits with an error if neither variable is set. Credentials are
// consumed from the environment only — nothing credential-related is read from
// disk, and requests go nowhere except api.github.com.
The checklist treats an English SKILL.md body and bilingual READMEs as publication requirements. No user language choice or justification for these constraints is documented.
The checklist treats specific documentation languages as a publishing requirement. It provides neither a user language choice nor a documented justification for enforcing English and Chinese.
Approval of public release contents is not approval to overwrite local originals, particularly when the workflow promises not to modify them. The writeback lacks a separate consent gate, backup requirement, or clear warning that sanitization and transformation may discard source information.
The instruction presents overwriting originals as necessary maintenance to prevent version regressions, encouraging an agent to cross the workflow's stated preservation boundary. Its exception for intentionally newer originals does not provide a reliable conflict check or substitute for user authorization.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
POST https://api.skillhub.cn/api/v1/community/skills/publish
The description template specifies a "one-line English summary," directing the agent to produce this metadata in a particular language. The file neither offers a language choice nor documents a platform requirement that justifies English-only descriptions.
The rollback procedure recommends removing usage restrictions and safety-relevant metadata based on scanner results while retaining the current body, conflating fewer findings with lower risk. Although it preserves genuine scope fixes, its blanket prohibition on restoring restrictions can remove meaningful guardrails and make risky capabilities less visible to users or reviewers.