ClawHub
Back to skill

Security audit

Clawhub Guard

Security checks for vulnerabilities and agentic risk

Overview

This skill is not clearly malicious, but it advertises safety checks it does not actually perform and can auto-install marketplace skills.

Use this only as a convenience wrapper, not as a real security reviewer. Do not rely on its risk ratings before installing skills, and avoid the install command unless you have independently inspected the target package and trust its source.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
clawhub_guard.py:54
Finding
Bypassable Vetting Allows Untrusted Marketplace Skills to Be Installed as Low Risk<![CDATA[ ## Vulnerability Details **File Location**: `clawhub_guard.py:54-94` and `clawhub_guard.py:171-193` **Vulnerability Type**: Weak, bypassable security validation before third-party skill installation **Risk Level**: High ### Vulnerable Code ```python def quick_vet(slug, description=""): """Quick risk assessment based on name and description.""" risk = "LOW" flags = [] desc_lower = description.lower() slug_lower = slug.lower() # Red flag patterns high_risk_keywords = [ "credential", "password", "token", "secret", "sudo", "root", "wallet", "trade", "exchange", "transfer", "payment", "auth", "login", "ssh", "key", ] medium_risk_keywords = [ "upload", "download", "fetch", "curl", "wget", "browser", "execute", "shell", "command", ] for kw in high_risk_keywords: if kw in slug_lower or kw in desc_lower: risk = "HIGH" flags.append(f"HIGH: contains '{kw}'") break if risk != "HIGH": for kw in medium_risk_keywords: if kw in slug_lower or kw in desc_lower: risk = "MEDIUM" flags.append(f"MEDIUM: contains '{kw}'") break # Known safe patterns safe_patterns = ["skill-vetter", "codegraph", "openclaw", "hermes", "cursor"] for sp in safe_patterns: if sp in slug_lower: risk = "LOW" flags = [] break return {"risk": risk, "flags": flags} ``` ```python def cmd_install(slug): print(f"Vetting {slug} before install...") out, err, rc = run_ch(["inspect", slug], timeout=30) vet = quick_vet(slug, out[:200]) risk_icon = {"LOW": "🟢", "MEDIUM": "🟡", "HIGH": "🔴"}.get(vet["risk"], "⚪") print(f" Risk: {risk_icon} {vet['risk']}") if vet["risk"] == "HIGH": print(f" ⚠ High risk skill — manual review recommended before install.") print(f" Run: clawhub install {slug} --for ...[truncated 2904 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Remove all substring-based trust overrides. A package must never be considered safe solely because its slug contains a recognized project name. 2. Integrate the actual `skill-vetter` review promised by the documentation and fail closed if that review is unavailable, incomplete, times out, or returns an error. 3. Retrieve and inspect the complete package contents rather than the first 200 characters of descriptive output. 4. Validate exact package and publisher identities using a maintained allowlist where appropriate; do not use partial-name matching. 5. Verify package signatures, checksums, provenance, and immutable version identifiers before installation when supported by the marketplace. 6. Check `rc`, `err`, and the completeness of inspection output. Abort installation on any nonzero return code, malformed response, or missing security result. 7. Require explicit user confirmation after displaying the complete review findings instead of automatically passing `-y`. 8. Treat unknown or inconclusive results as blocked or HIGH risk rather than defaulting to LOW. 9. Run installation and subsequent review in a sandbox with minimal filesystem, credential, tool, and network access. 10. Update `SKILL.md` so its security claims accurately match the implemented behavior until genuine `skill-vetter` integration is present. ]]>

SkillSpector

Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (8)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The documented security claims do not match the described behavior: the skill presents itself as a safety guard with integrated vetting, yet static analysis indicates it can install skills and may rely only on superficial local scoring rather than the claimed review mechanism. This is dangerous because users may place elevated trust in its recommendations and auto-install path, causing unsafe skills to be installed under a false sense of security.

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill advertises shell-backed behavior via commands like scanning, auditing, and installing, but the manifest does not declare any tool scope such as allowed-tools or permissions. That creates a trust and review gap: consumers and policy engines cannot accurately constrain or evaluate what the skill is allowed to execute, which is especially risky for a skill that invokes marketplace and installation operations.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
def run_ch(args, timeout=60):
    r = subprocess.run([CLAWHUB_BIN] + args, capture_output=True, text=True, timeout=timeout)
    return r.stdout, r.stderr, r.returncode
Confidence
70% confidence
Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Intent-Code Divergence

Medium
Confidence
96% confidence
Finding
The audit command claims to check installed skills for updates but actually runs inspect on each skill, creating a misleading security posture. Users may rely on this command to maintain patch hygiene and wrongly assume vulnerable or outdated skills have been reviewed for updates when they have not.

Description-Behavior Mismatch

Medium
Confidence
96% confidence
Finding
The skill presents itself as a marketplace safety guard but also performs installation of third-party skills, which is a system-changing action based only on weak keyword vetting. In this context, the mismatch is dangerous because users may trust the tool's safety framing and allow it to install untrusted code that the simplistic vetting logic misclassifies as safe.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The code automatically runs installation with '-y' after only a shallow heuristic check, with no explicit user confirmation immediately before the system-changing action. In a marketplace tool that handles third-party skills, this materially increases the chance of silent installation of malicious or overly privileged content.

Natural-Language Policy Violations

Low
Confidence
91% confidence
Finding
The natural-language description, examples, and workflow are presented only in Chinese, which imposes a specific language on users. Under the stated policy, a forced language or locale without user opt-in is a policy violation unless the constraint is clearly documented and justified.

Natural-Language Policy Violations

Low
Confidence
87% confidence
Finding
The top-level natural-language description is presented in Chinese only, with no indication that the user can choose another language or locale. That can violate a language-choice policy when the skill is not clearly documented as region-specific.

Static analysis

No suspicious patterns detected.