ClawHub
Back to skill

Security audit

SkillChain

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly matches its supply-chain analysis purpose, but it needs review because it broadly indexes local skills and automatically loads code from a sibling ontology skill without integrity checks.

Install only if you are comfortable with a skill that inventories other local skills and stores a local graph of their metadata. Run scan and enrich deliberately, avoid using enrich if you do not want installed skill slugs queried against clawhub.ai, and be cautious if an ontology sibling skill is installed because this package will automatically import and execute that sibling Python module.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
scripts/ingest.py:67
Finding

Unverified sibling ontology module execution during ingestion

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
scripts/analyze.py:27
Finding

Unverified sibling ontology module execution during analysis

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (22)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md
python3 scripts/ingest.py analyze-all

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md
python3 scripts/ingest.py analyze-all

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md
python3 scripts/ingest.py analyze-all

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md
python3 scripts/ingest.py analyze-all

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md
python3 scripts/ingest.py analyze-all

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

md
python3 scripts/ingest.py analyze-all

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

md
python3 scripts/ingest.py analyze-all

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

md
python3 scripts/ingest.py analyze-all

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.

md
| `SKILL.md` frontmatter | name, description, license, `allowed-tools`, `metadata.requires.bins`, `read_when` | Yes |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.

md
| `SKILL.md` frontmatter | name, description, license, `allowed-tools`, `metadata.requires.bins`, `read_when` | Yes |

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
85% confidence
Finding

The skill documentation describes capabilities that imply file access, graph writes, shell execution, and optional network enrichment, but the frontmatter does not declare any explicit tool scope or permissions. This creates a transparency and least-privilege problem: an agent may invoke a skill whose effective capabilities are broader than what the manifest signals, increasing the chance of unsafe execution or over-privileged use.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The trigger phrase "Analyze my skills" is broad and likely to overlap with ordinary user requests, which can cause the skill to activate in situations the user did not specifically intend. In this skill's context, activation leads to local skill ecosystem scanning and optional enrichment behavior, so accidental invocation could expose inventory details or cause unnecessary analysis actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The documented reset workflow rebuilds storage and references append-only graph data, but it does not prominently warn that reset may delete or overwrite previously collected graph state. A user or agent following the one-shot or reset instructions could unintentionally destroy local analysis data, making this a real integrity and availability risk.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md
python3 scripts/ingest.py scan

# Specify directories explicitly
python3 scripts/ingest.py scan --dirs ~/Downloads/skills-main/skills ~/.codex/skills ~/Downloads/ontology

# Online enrichment: adds stars, downloads, moderation verdict from clawhub
# Skipped automatically if network is unavailable

Dynamic import via __import__()

Medium
Category
Dangerous Code Execution
Confidence
75% confidence
Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/ingest.py (reported line 339)May include surrounding context.

python
"""Parse pyproject.toml: try tomllib/tomli, fall back to regex."""
    for mod in ("tomllib", "tomli"):
        try:
            lib = __import__(mod)
            data = lib.loads(text)
            _parse_pyproject_data(data, add_fn)
            return

Dynamic import via __import__()

Medium
Category
Dangerous Code Execution
Confidence
89% confidence
Finding

This dynamically imports ontology after prepending a filesystem path derived from a relative location outside the current skill directory, then invokes append_op on the imported module. If an attacker can place or replace an ontology.py in that searched location, they can gain code execution when this script runs, making this a local module-hijacking risk tied to import-path manipulation.

Content

Scanner excerpt · scripts/ingest.py (reported line 658)May include surrounding context.

python
ts = datetime.now(timezone.utc).isoformat()
        rec = {"op": "update", "id": eid, "properties": props, "timestamp": ts}
        _append_op_fallback(GRAPH_PATH, rec) if not _ONTOLOGY_OK else \
            __import__("ontology").append_op(GRAPH_PATH, rec)
        entities[eid]["properties"].update(props)
        return eid
    entity = _mkent("Skill", {**props, "slug": slug}, GRAPH_PATH)

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest emphasizes local ecosystem analysis, dependency discovery, security posture, and inventory of installed skills. This file adds a network-backed enrichment capability that fetches remote metadata from clawhub.ai, which is broader than purely local analysis and is not reflected in the stated description.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
82% confidence
Finding

A supply-chain intelligence skill is expected to read local manifests and files, but spawning npm root -g is a separate capability that executes an external program on the host. The manifest does not mention shelling out or requiring command execution as part of the skill's scope.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/ingest.py (reported line 811)May include surrounding context.

python
# Global npm skills directory: $(npm root -g)/openclaw/skills
    try:
        proc = subprocess.run(
            ["npm", "root", "-g"],
            capture_output=True,
            text=True,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The reset command unconditionally clears the graph file by writing an empty string, which is a destructive operation that removes stored data. The code provides a post-action print message but no prior confirmation prompt or explicit warning in the command implementation before deletion occurs.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/ingest.py (reported line 987)May include surrounding context.

python
print("=" * 60)
        print(step)
        print("=" * 60)
        _sp.run([_sys.executable, str(analyze), subcmd], check=False)


# ---------------------------------------------------------------------------

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

This code writes generated content to an arbitrary path supplied by --out, which is a file-modifying operation. Although the CLI help mentions writing a report, there is no confirmation prompt or explicit runtime disclosure before overwriting/creating the target file.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.