Security audit

publish-skills

Security checks for vulnerabilities and agentic risk

Overview

This skill is a scoped publishing runbook for ClawHub skills and does not contain hidden code, persistence, or credential-stealing behavior.

Install this only if you work with the named ClawHub publishing repos and understand that following it may push repository changes and publish skills under the j3ffyang account. Keep ClawHub tokens in repo secrets or environment variables and verify workflow guards before publishing.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Ae1

High

Category: analysis-evasion
Content: ty-downloader` handled via a matrix `skill_path` entry. Data folders without a `SKILL.md` (e.g. `openclaw/twitter-bookmarks-exporter`) are skipped automatically
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: ty-downloader` handled via a matrix `skill_path` entry. Data folders without a `SKILL.md` (e.g. `openclaw/twitter-bookmarks-exporter`) are skipped automatically
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: ty-downloader` handled via a matrix `skill_path` entry. Data folders without a `SKILL.md` (e.g. `openclaw/twitter-bookmarks-exporter`) are skipped automatically
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The introductory documentation states that 'skills are never published manually,' which conveys a strict no-manual-publish rule. Later, the procedure explicitly says to 'Manually trigger a publish' via workflow_dispatch, which is a direct contradiction in operator guidance rather than a mere omission.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: Line L27 warns 'Never create or run a manual publish path that could double-publish to ClawHub,' establishing a prohibition on manual publish paths. The later step at L49 instructs users to manually trigger a publish, creating contradictory operational guidance about whether manual invocation is acceptable.

Static analysis

No suspicious patterns detected.