ClawHub
Back to skill

Security audit

Skill Batch Operations

Security checks for vulnerabilities and agentic risk

Overview

ClawScan labels this skill benign because its reported behavior appears aligned with its purpose, though the scan has one incomplete reference and flagged two purpose-expected items.

The verdict is benign with medium confidence, not a guarantee of safety. Skillspector’s analysis is partial because a local reference was missing, and it flagged a credential-path reference and an external URL. Review the skill’s details and consider whether those references fit your needs before installing.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

md
nfirm tombstone state on a possibly-alive skill — use the public-detail 404 + publish 409 pattern instead |
| SkillHub | publish of an ALIVE existing skill = same endpoint, upserts; response `skillId=<old id> status=None`, and `latestVersion` in API only updates after review queue clears | after publish, check `latestVersion` later; do not misread it as failure |
| SkillHub | working publish channel = `POST https://api.skillhub.cn/api/v1/community/skills/publish`, Bearer token from `~/.skillhub/credentials.json`, multipart: `payload` (JSON: slug/displayName/version/summary/summaryZh/changelog/tags) + `files` parts (filename = relative path). The clawhub-CLI-with-swapped-registry route does NOT work (skillhub has no `/whoami` or `/publish/token/mint`); direct POST to `/api/v1/skills` 401s (publish route only accepts minted clawhub tokens) | use the community endpoint via script; no skillhub CLI exists |
| SkillHub | transient `503 Service Temporarily Unavailable` (stgw edge) can hit pub

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

md
eb console (个人中心 → 我的 Skill), then CLI publish upserts normally; never probe DELETE to confirm tombstone state on a possibly-alive skill — use the public-detail 404 + publish 409 pattern instead |
| SkillHub | publish of an ALIVE existing skill = same endpoint, upserts; response `skillId=<old id> status=None`, and `latestVersion` in API only updates after review queue clears | after publish, check `latestVersion` later; do not misread it as failure |
| SkillHub | working publish channel = `POST https://api.skillhub.cn/api/v1/community/skills/publish`, Bearer token from `~/.skillhub/credentials.json`, multipart: `payload` (JSON: slug/displayName/version/summary/summaryZh/changelog/tags) + `files` parts (filename = relative path). The clawhub-CLI-with-swapped-registry route does NOT work (skillhub has no `/whoami` or `/publish/token/mint`); direct POST to `/api/v1/skills` 401s (publish route only accepts minted clawhub tokens) | use the community endpoint via script; no skillhub CLI exis