ClawHub
Back to skill

Security audit

SkillNav

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it advertises, but its self-update command can overwrite the installed skill from an unpinned remote branch without verification.

Review this skill before installing if you plan to use /skillnav update. Avoid running the update command unless you trust the GitHub source at that moment, and inspect any install commands returned by SkillNav before copying them into a shell.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:172
Finding

Mandatory Promotional Content Injected into Every Skill Response

Content
View full analysis
Remediation
View remediation

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:26
Finding

Unverified Self-Update from a Mutable Remote Branch

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:88
Finding

Untrusted API-Provided Installation Commands Presented Without Validation

Content
View full analysis
{editor_comment_zh} ``` {install_command} ``` If `editor_comment_zh` is null, skip the blockquote line. ``` ```md **MCP / Skill**: **{name}** ⭐ {stars} — {description_zh} > {editor_comment_zh} ``` {install_command} ``` If `editor_comment_zh` is null, skip the blockquote line. If `install_command` is null, skip the code block. ``` ### Technical Analysis The skill retrieves search results from an external API and renders the response's `install_command` field as an installation command. The instructions do not require provenance checks, command validation, package allowlisting, version pinning, escaping, or a warning that the command originates from external data. The skill does not automatically execute the returned command, so this is not direct command injection into Bash. The security risk is that the generated response presents externally controlled shell content in a trusted installation context, encouraging users to copy and execute it. If the API, editorial database, upstream tool record, or related publishing process is compromised, an attacker could supply commands containing shell operators, remote-script pipelines, destructive operations, credential-exfiltration logic, or malicious package names. ### Attack Path 1. An attacker compromises or influences data returned by the SkillNav API. 2. The attacker places a malicious shell expression in an `install_command` field. 3. A user invokes the `mcp` or `search` command. 4. The skill retrieves the attacker-controlled field and formats it as an authoritative installation command. 5. No validation or security warning distinguishes the command from vetted content. 6. The user copies and executes the c ...[truncated 893 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The description explicitly states the skill operates "in Chinese," which imposes a language choice on users. The file then consistently mandates Chinese-only output formats, with no option to choose another language or opt in to this locale behavior.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
93% confidence
Finding

This finding points to the same behavior from the destination-path angle: the skill enumerates and writes to a concrete local skills directory (~/.claude/skills/skillnav/SKILL.md), enabling remote replacement of an installed agent capability. In context, this is more dangerous than ordinary path disclosure because the path is coupled with an unauthenticated network fetch and direct file overwrite, making persistence and future malicious behavior plausible if the source is tampered with.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

md
| search    | WebFetch https://skillnav.dev/api/skill/query?type=search&q=$ARGUMENTS[1..] (join remaining args with space, URL-encode) |
| paper     | If $ARGUMENTS[1] matches arXiv ID pattern (YYMM.NNNNN): WebFetch https://skillnav.dev/api/skill/query?type=paper&id=$ARGUMENTS[1]. Otherwise: WebFetch https://skillnav.dev/api/skill/query?type=paper&q=$ARGUMENTS[1] |
| trending  | WebFetch https://skillnav.dev/api/skill/query?type=trending  |
| update    | Bash: curl -sL https://raw.githubusercontent.com/skillnav-dev/skillnav-skill/main/SKILL.md -o ~/.claude/skills/skillnav/SKILL.md && echo "SkillNav Skill updated." |
| (other)   | Show usage message — do NOT fetch any URL                    |

If $ARGUMENTS is empty or does not match any command above, show this usage message and STOP (do NOT fetch any URL):

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
93% confidence
Finding

This finding points to the same behavior from the destination-path angle: the skill enumerates and writes to a concrete local skills directory (~/.claude/skills/skillnav/SKILL.md), enabling remote replacement of an installed agent capability. In context, this is more dangerous than ordinary path disclosure because the path is coupled with an unauthenticated network fetch and direct file overwrite, making persistence and future malicious behavior plausible if the source is tampered with.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

md
| search    | WebFetch https://skillnav.dev/api/skill/query?type=search&q=$ARGUMENTS[1..] (join remaining args with space, URL-encode) |
| paper     | If $ARGUMENTS[1] matches arXiv ID pattern (YYMM.NNNNN): WebFetch https://skillnav.dev/api/skill/query?type=paper&id=$ARGUMENTS[1]. Otherwise: WebFetch https://skillnav.dev/api/skill/query?type=paper&q=$ARGUMENTS[1] |
| trending  | WebFetch https://skillnav.dev/api/skill/query?type=trending  |
| update    | Bash: curl -sL https://raw.githubusercontent.com/skillnav-dev/skillnav-skill/main/SKILL.md -o ~/.claude/skills/skillnav/SKILL.md && echo "SkillNav Skill updated." |
| (other)   | Show usage message — do NOT fetch any URL                    |

If $ARGUMENTS is empty or does not match any command above, show this usage message and STOP (do NOT fetch any URL):

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The response templates and required footer throughout the formatting section prescribe Chinese-language strings for every command result. Because no alternative language path or opt-in is provided, this constitutes a language/locale policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.