Security audit

Skill 发布指南

Security checks for vulnerabilities and agentic risk

Overview

ClawScan rates this skill suspicious with medium confidence because several examples use unpinned command-line tools that could fetch and run unreviewed releases; this is a review warning, not a finding of malicious intent.

Before installing, consider whether you trust the guide's publishing workflow and are comfortable running its unpinned commands. Prefer reviewed, exact CLI versions and use an account with limited permissions. The scan was partial: two local references were missing, so the evidence does not establish that all referenced material was inspected.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (10)

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · references/clawhub.md (reported line 38)May include surrounding context.
md
用有权限的 owner inspect/状态入口关联本次版本，再核对它在公共读取/下载面的 owner、slug、版本和内容。CLI 退出码 0、接收回执或旧版可安装都不能单独证明目标新版已公开。来源：[当前 CLI 文档](https://github.com/openclaw/clawhub/blob/main/docs/cli.md)、[发布流程](https://github.com/openclaw/clawhub/blob/main/docs/publishing.md)、[官方 ClawHub skill](https://github.com/openclaw/openclaw/blob/main/skills/clawhub/SKILL.md)。旧示例可能使用兼容命令，以当前官方帮助为准。

MCP server referenced without pinned version: 'npx @skill-hub/cli'.

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The executable init example uses an unpinned npm package even though the documented behavior was evaluated against version 0.1.9. This is a CLI rather than an MCP server, but npx can still fetch and execute an unreviewed release with the agent's permissions; staging limits accidental file changes, not malicious code access.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx @skill-hub/cli'.

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The push command can resolve an unreviewed CLI release instead of the version whose file-selection behavior the guide describes. A compromised release could access publishing credentials or upload files outside the intended manifest, making version drift particularly consequential in this publishing workflow.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx @skill-hub/cli'.

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The publish example executes a mutable npm dependency in a workflow with authenticated remote-write capabilities. Although the guide requires publication authorization and version checks, those safeguards do not ensure that the code executed is the reviewed release or prevent a compromised CLI from misusing credentials.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/skillhub-cn.md (reported line 82)May include surrounding context.
md
版本已公开、简介已更新、概述仍旧可以同时存在。未知审核状态不能自动写成待审；旧版仍公开且本次待审有实际证据时，同时报告“旧版可见、目标新版待审”。用 [发布记录模板](submission-record.md) 保存各项时间、比较结果与未完成事项，不能以摘要、HTTP 2xx 或新版本号代替概述验收。来源：[官网](https://skillhub.cn/)、[官方教程](https://skillhub.cn/tutorials 发布规范](https://skillhub.cn/ai/release.md)、[当前客户端](https://cloudcache.tencent-cloud.com/qcloud/tea/app/skillhub/assets/skill-hub.bb2n2rxv.js?max_age=31536000%29%E3%80%81%5B%E5%85%AC%E5%BC%80%E5%88%97%E8%A1%A8%E6%8E%A5%E5%8F%A3%5D%28https%3A%2F%2Fapi.skillhub.cn%2Fapi%2Fskills%3Fpage%3D1&pageSize=1%29%E3%80%82%E5%AE%A2%E6%88%B7%E7%AB%AF%E8%B5%84%E6%BA%90%E4%BC%9A%E5%8F%98%EF%BC%8C%E5%90%8E%E7%BB%AD%E4%BB%8E%E5%AE%98%E7%BD%91%E9%87%8D%E6%96%B0%E5%AE%9A%E4%BD%8D%EF%BC%9B%E6%9D%A5%E6%BA%90%E7%AD%89%E7%BA%A7%E8%A7%81 [维护页](sources-and-maintenance.md)。

MCP server referenced without pinned version: 'npx skills'.

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: The executable listing example uses an unpinned npm CLI, allowing npx to fetch and run code that was not covered by the guide's verification. Although --list appears read-only, it does not sandbox the CLI or prevent a compromised package from accessing the agent's files and credentials.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: This installation command leaves the executable npm CLI unpinned; the repository's @REF selects skill content, not the CLI version. An unreviewed or compromised CLI release could execute with the agent's permissions, and using a separate installation directory does not by itself provide process isolation.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skillstore'.

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.