ClawHub
Back to skill

Security audit

ClawHub Studio

Security checks across malware telemetry and agentic risk

Overview

ClawHub Studio is a coherent local skill-building app, but it deserves review because its local API can mint tokens without credentials and then run skill code or publish through the user's ClawHub CLI.

Install only on a trusted single-user machine, keep the localhost port private, and treat every self-test as executing code with your user permissions. Use dry-run publishing unless you are ready to publish, and be aware that a local process could mint a token and call the publish API if your clawhub CLI is authenticated.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
if not os.path.isfile(tool_path):
        return {"passed": False, "rc": -1, "output": f"no such file: {tool_path}"}
    try:
        r = subprocess.run(
            [sys.executable, tool_path, "self-test"],
            capture_output=True, text=True, timeout=timeout,
        )
Confidence
93% confidence
Finding
r = subprocess.run( [sys.executable, tool_path, "self-test"], capture_output=True, text=True, timeout=timeout, )

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill advertises and appears to rely on sensitive capabilities including shell execution, file read/write, environment access, and network access, but declares no explicit permissions. This creates a trust and containment problem: a caller or hosting platform may grant broader access than expected, and users cannot make an informed security decision from the manifest alone.

Description-Behavior Mismatch

Medium
Confidence
99% confidence
Finding
The login endpoint issues a bearer token to any caller without validating credentials, so the application's authorization boundary is effectively nonexistent. Any local process, malicious webpage abusing localhost reachability, or user on a shared machine could obtain a valid token and then create, modify, test, and publish skills through authenticated endpoints.

Unvalidated Output Injection

High
Category
Output Handling
Content
if not os.path.isfile(tool_path):
        return {"passed": False, "rc": -1, "output": f"no such file: {tool_path}"}
    try:
        r = subprocess.run(
            [sys.executable, tool_path, "self-test"],
            capture_output=True, text=True, timeout=timeout,
        )
Confidence
89% confidence
Finding
subprocess.run( [sys.executable, tool_path, "self-test"], capture_output

Unvalidated Output Injection

High
Category
Output Handling
Content
harness = os.path.join(os.path.dirname(__file__), "..", "ci", "verify_product.py")
    harness = os.path.abspath(harness)
    if os.path.isfile(harness):
        r = subprocess.run(
            [sys.executable, harness, folder],
            capture_output=True, text=True, timeout=120,
        )
Confidence
72% confidence
Finding
subprocess.run( [sys.executable, harness, folder], capture_output

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.