ClawHub
Back to skill

Security audit

Blog Editor

Security checks for vulnerabilities and agentic risk

Overview

This is a low-risk Markdown blog editing skill, with minor workflow cautions around broad activation and saving an edited copy.

Install only if you want an agent to edit Markdown writing and potentially save an edited copy named after the original file. Review the edited draft before using it, especially when the request is not clearly a blog post, because the trigger wording is broad.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (6)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · 260306_openClawExp.md (reported line 49)May include surrounding context.

md
w/clawhub)
    - eg, `clawhub list` and `clawhub install ddg-web-search`
    - up to 20260307, ~5700 in **community** with high-quality (active) ~3000, at ClawHub.ai
    - My published skill > https://clawhub.ai/dashboard
    - See below for more info
- Automation
- Media

#### Skills

Skills are organized into approximately 28 categories to help users find specific functionalities: 

- Developer Tools: Includes GitHub integration, Linear project management, and automated coding agents (543+ skills).
- AI & LLMs: Tools for specialized models, prompt engineering, and consciousness frameworks (287+ skills).
- Search & Research: Specialized scrapers using Playwright and academic research tools (253+ skills).
- Social & Communication: Email infrastructure via AgentMail and social network integrations for agents (189+ skills).

> Ref > [opencaw how many skills in clawhub community](https://www.google.com/search?client=firefox-b-d&q=openclaw+how+many+skills+in+clawhub+community+totally&udm=5

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

md
English. Do NOT translate unless a sentence mixes languages in a way that
  breaks meaning.
- If you do change language in a spot (rare), **highlight it** with a comment
  like: `<!-- ⚠️ Language changed here: [reason] -->`
- If there's genuinely conflicting content between the two languages in a
  bilingual post, flag it to the user before changing anything.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

This markdown file is in scope for natural-language policy checks. The statement elevates English over other languages as a default framing for model use, which can create a language-bias or locale policy issue because it does not present language preference as a user choice or clearly justify the constraint.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · 260306_openClawExp.md (reported line 116)May include surrounding context.

md
#### Security (永遠的話題)

- Protect all of your API keys - `chmod 700 .openclaw/credentials/` 
- Channel > `openclaw channels list`
- Network: `openclaw gateway` with proxy, eg. `openclaw tui`
- 永遠的話題。這個可以成為一個有償服務！

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger criteria are broad enough to match many generic writing-editing requests such as 'check my writing' or 'review my draft,' which can cause the skill to activate outside its intended scope. Over-broad activation increases the chance of unintended tool routing, unexpected file handling, or the model following this skill when a safer or more specific workflow would be more appropriate.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill directs the agent to save an edited file as '[original-filename]-edited.md' without requiring explicit user confirmation before writing. This can lead to unexpected file creation or modification in the user's workspace, which is risky even for benign content-editing tasks because it crosses from suggestion into action without consent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.