ClawHub
Back to skill

Security audit

Universal Skills Manager

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed multi-tool skill manager, but its install paths include unsafe remote-shell, archive, destination, and force-bypass behaviors that deserve manual review before use.

Install only if you are comfortable giving this skill manager write access to your AI skill folders. Avoid the curl | sh workaround, use dry-run first, do not use --force or --skip-scan unless you have manually reviewed the target, keep destinations inside a single intended skill directory, and do not embed an API key in a ZIP you might share or sync.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:73
Finding

Unpinned Remote Installation Script Is Piped Directly to a Shell

Content
View full analysis
Remediation
View remediation
/install.sh ``` 4. Publish the expected SHA-256 digest through an independently authenticated release channel and require verification: ```bash printf '%s %s\n' '' install.sh | sha256sum --check - ``` 5. Prefer signed release artifacts and verify the maintainer's signature. 6. Instruct the user to inspect the downloaded script before executing it: ```bash less install.sh sh install.sh --tools claude ``` 7. Run installation with the minimum necessary user privileges and never recommend elevation unless a narrowly justified operation requires it. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/install_skill.py:734
Finding

Unrestricted Destination Can Replace Arbitrary User-Writable Directories

Content
View full analysis
None: """ Copy validated skill from temp to destination using atomic swap. If destination exists: 1. Check for symlinks (safety) 2. Rename dest -> dest.bak 3. Copy temp -> dest 4. On success: remove dest.bak 5. On failure: remove partial dest, restore dest.bak """ dest.parent.mkdir(parents=True, exist_ok=True) backup_path = dest.with_name(dest.name + ".bak") if dest.exists(): # Safety: check for symlinks in existing directory _check_for_symlinks(dest) # Remove any stale backup from a previous failed install if backup_path.exists(): shutil.rmtree(backup_path) # Step 1: Move existing to backup if verbose: print(f" Backing up existing: {dest.name} -> {dest.name}.bak") os.rename(str(dest), str(backup_path)) try: # Step 2: Copy new content shutil.copytree(str(temp_dir), str(dest)) # Step 3: Success - remove backup shutil.rmtree(backup_path) if verbose: print(f" Removed backup: {backup_path.name}") except Exception: # Step 4: Failure - restore backup if dest.exists(): shutil.rmtree(dest) os.rename(str(backup_path), str(dest)) raise else: shutil.copytree(str(temp_dir), str(dest)) ``` The destination is accepted directly from the command line: ```python dest = Path(args.dest).expanduser().resolve() check_root_skills_directory_safety(dest, args.force) ``` The `--force` option is documented as bypassing safety checks: ```python parser.add_argument( ...[truncated 2152 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:594
Finding

Unvalidated Slug Interpolation Enables Shell and Path Injection

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:604
Finding

Remote ClawHub Archives Are Extracted Without Entry Validation

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:409
Finding

API Keys Can Be Stored in Plaintext Inside Persistent Distributable ZIP Files

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
Findings (56)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The description presents a broad orchestration/coordinator component that discovers skills from several hubs and synchronizes them across many AI platforms and scope levels. The code chunk does not implement discovery, multi-source support, or cross-tool synchronization. Instead, it is a focused command-line installer for downloading a skill directory from GitHub, validating its contents, scanning it with a local helper script if available, installing it safely, and maintaining a local manifest. While installation is part of the declared purpose, the primary behavior is much narrower and materially different from the claimed coordinator functionality.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description and the supplied code have materially different primary purposes. The description promises a coordinator/manager for discovering, installing, and syncing skills across multiple platforms and scopes. The code does none of that. It is a zero-dependency Python CLI scanner focused on detecting security issues in skill packages via regex- and file-based analysis. This is not a supporting implementation detail of a coordinator; it is an entirely different tool with separate capabilities, inputs, and outputs. Therefore this is a clear mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description describes a broad skill-management/orchestration system that discovers skills from several remote sources and manages installation/synchronization across multiple AI platforms. The supplied code does none of that. It locally parses, validates, reports on, and optionally fixes YAML frontmatter in SKILL.md files or ZIP archives. It performs file I/O and ZIP rewriting, but there is no network access, no discovery from SkillsMP/SkillHub/ClawHub, no installation workflow, no synchronization logic, and no user/project scope management. This is a clear material mismatch in primary purpose and capabilities.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

md
* Look for folders containing `SKILL.md` - this is the actual skill directory

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 469)May include surrounding context.

md
* Look for folders containing `SKILL.md` - this is the actual skill directory

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 470)May include surrounding context.

md
* Look for folders containing `SKILL.md` - this is the actual skill directory

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 471)May include surrounding context.

md
* Look for folders containing `SKILL.md` - this is the actual skill directory

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 547)May include surrounding context.

md
* Look for folders containing `SKILL.md` - this is the actual skill directory

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
96% confidence
Finding

Using printenv SKILLSMP_API_KEY to actively read environment secrets is sensitive behavior. Even if intended for legitimate API access, harvesting a credential from the environment expands exposure because the skill can then forward or persist it in subsequent commands and packaging workflows.

Content

Scanner excerpt · SKILL.md (reported line 176)May include surrounding context.

md
1.  **Discover API Key and Select Source:**
    *   **Step 1 - Environment Variable:** Check `$SKILLSMP_API_KEY`
        ```bash
        printenv SKILLSMP_API_KEY
        ```
        If set and non-empty, use SkillsMP as the primary search source.
        **Note:** Use `printenv` (not `echo $VAR`) — it queries the process environment directly and is more reliable across shell contexts.

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

The skill reads from ~/.claude/skills/universal-skills-manager/config.json, which is inside an agent configuration area and may contain secrets such as API keys. Accessing config directories is sensitive because it can expose credentials or internal configuration not necessary for many user requests.

Content

Scanner excerpt · SKILL.md (reported line 184)May include surrounding context.

md
*   **Step 2 - Config File:** Check for `config.json` in this skill's directory
        ```bash
        # Look for config.json in skill directory (path varies by tool)
        cat ~/.claude/skills/universal-skills-manager/config.json 2>/dev/null
        ```
        If `skillsmp_api_key` field has a non-empty value, use SkillsMP as primary source.

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
96% confidence
Finding

Capturing the API key into a shell variable from the environment is another form of credential harvesting and handling. This increases the chance of accidental disclosure through process inspection, debugging output, copied commands, or downstream packaging into config.json.

Content

Scanner excerpt · SKILL.md (reported line 220)May include surrounding context.

md
-   **IMPORTANT:** Always include a `User-Agent` header. SkillsMP is behind Cloudflare, which blocks bare curl requests (403 Forbidden).
        ```bash
        # Step 1: Capture key (do this once per session)
        API_KEY=$(printenv SKILLSMP_API_KEY)

        # Step 2: Use ${API_KEY} in curl commands (User-Agent required)
        # Keyword Search

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

Deleting both /tmp/clawhub-{slug}/ and /tmp/clawhub-{slug}.zip via one shell command compounds the risk of parameter abuse and accidental wildcard/option interpretation. In an installer/downloader skill, this is more dangerous because the values originate from external content identifiers and are used in privileged local file operations.

Content

Scanner excerpt · SKILL.md (reported line 638)May include surrounding context.

md
7.  **Cleanup:**
    -   Remove the temporary directory:
        ```bash
        rm -rf /tmp/clawhub-{slug}/ /tmp/clawhub-{slug}.zip
        ```

#### D. Installing from Local Source (Sync/Copy)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

Deleting both /tmp/clawhub-{slug}/ and /tmp/clawhub-{slug}.zip via one shell command compounds the risk of parameter abuse and accidental wildcard/option interpretation. In an installer/downloader skill, this is more dangerous because the values originate from external content identifiers and are used in privileged local file operations.

Content

Scanner excerpt · SKILL.md (reported line 638)May include surrounding context.

md
7.  **Cleanup:**
    -   Remove the temporary directory:
        ```bash
        rm -rf /tmp/clawhub-{slug}/ /tmp/clawhub-{slug}.zip
        ```

#### D. Installing from Local Source (Sync/Copy)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

Deleting both /tmp/clawhub-{slug}/ and /tmp/clawhub-{slug}.zip via one shell command compounds the risk of parameter abuse and accidental wildcard/option interpretation. In an installer/downloader skill, this is more dangerous because the values originate from external content identifiers and are used in privileged local file operations.

Content

Scanner excerpt · SKILL.md (reported line 638)May include surrounding context.

md
7.  **Cleanup:**
    -   Remove the temporary directory:
        ```bash
        rm -rf /tmp/clawhub-{slug}/ /tmp/clawhub-{slug}.zip
        ```

#### D. Installing from Local Source (Sync/Copy)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 883)May include surrounding context.

md
nd ClawHub's VirusTotal `moderation` status are informational only — our own `scan_skill.py` at install time is authoritative.

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
90% confidence
Finding

The '--force' option explicitly bypasses prompts and root-directory safety checks, and elsewhere it also allows proceeding despite security-scan findings. In the context of a skill installer that downloads untrusted content and overwrites existing skills, this materially weakens defensive controls and makes accidental or coerced unsafe installation much easier.

Content

Scanner excerpt · scripts/install_skill.py (reported line 911)May include surrounding context.

python
)
    parser.add_argument(
        '--force', action='store_true',
        help='Overwrite existing skill without prompting and bypass safety checks'
    )
    parser.add_argument(
        '--dry-run', action='store_true',

Instruction Override

High
Category
Prompt Injection
Confidence
90% confidence
Finding

A user-facing 'bypass safety checks' capability is dangerous in this context because the script handles untrusted remote content, local file replacement, and optional security scanning. Even if intended for recovery scenarios, such wording and behavior can normalize disabling protections and enable destructive or unsafe installs in automation.

Content

Scanner excerpt · scripts/install_skill.py (reported line 911)May include surrounding context.

python
)
    parser.add_argument(
        '--force', action='store_true',
        help='Overwrite existing skill without prompting and bypass safety checks'
    )
    parser.add_argument(
        '--dry-run', action='store_true',

Self-Modification

High
Category
Rogue Agent
Confidence
86% confidence
Finding

The specific ability to bypass safety checks while overwriting installed skills creates a realistic path to destructive modification of the local skill environment. In a tool that coordinates skills across multiple AI tools and supports global/project scopes, unsafe overwrite behavior can propagate compromised or malformed skills broadly.

Content

Scanner excerpt · scripts/install_skill.py (reported line 911)May include surrounding context.

python
)
    parser.add_argument(
        '--force', action='store_true',
        help='Overwrite existing skill without prompting and bypass safety checks'
    )
    parser.add_argument(
        '--dry-run', action='store_true',

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

The specific ability to bypass safety checks while overwriting installed skills creates a realistic path to destructive modification of the local skill environment. In a tool that coordinates skills across multiple AI tools and supports global/project scopes, unsafe overwrite behavior can propagate compromised or malformed skills broadly.

Content

Scanner excerpt · scripts/install_skill.py (reported line 911)May include surrounding context.

python
)
    parser.add_argument(
        '--force', action='store_true',
        help='Overwrite existing skill without prompting and bypass safety checks'
    )
    parser.add_argument(
        '--dry-run', action='store_true',

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/scan_skill.py (reported line 48)May include surrounding context.

python
".rb", ".pl", ".lua", ".ps1", ".bat", ".cmd",
})
_CONFIG_EXTENSIONS = frozenset({
    ".json", ".yaml", ".yml", ".toml", ".ini", ".cfg", ".env",
})
_BUILD_BASENAMES = frozenset({
    "Makefile", "Dockerfile", "Jenkinsfile", "Containerfile",

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · scripts/scan_skill.py (reported line 100)May include surrounding context.

python
re.IGNORECASE),
        "Markdown image with variable interpolation — may exfiltrate data via URL",
    ),
    (
        re.compile(r'<img\s[^>]*src\s*=\s*["\']https?://', re.IGNORECASE),
        "HTML img tag with external URL — may load tracking pixel or exfiltrate data",
    ),
    (
        re.compile(r'!\[.*?\]\(https?://[^)]*\?[^)]*=', re.IGNORECASE),
        "Markdown image with query parameters — may exfiltrate data via URL parameters",
    ),
    (
        re.compile(r'!\[.*?\]\(data:', re.IGNORECASE),
        "Markdown image with data URI — may contain embedded malicious payload",
    ),
    (
        re.compile(r'!\[.*?\]\(//[^)]+', re.IGNORECASE),
        "Markdown image with protocol-relative URL — may exfiltrate data",
    ),
    (
        re.compile(r'href\s*=\s*["\']javascript:', re.IGNORECASE),
        "JavaScript URI in link — arbitrary code execution risk",
    ),
    (
        re.compile(r'src\s*=\s*["\']data:', re.IGNORECASE),
        "Data URI in src

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/scan_skill.py (reported line 137)May include surrounding context.

python
r'id_ecdsa',
        r'\.pem\b',
        r'\.key\b',
        r'/etc/passwd',
        r'/etc/shadow',
    ]
]

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/scan_skill.py (reported line 138)May include surrounding context.

python
r'\.pem\b',
        r'\.key\b',
        r'/etc/passwd',
        r'/etc/shadow',
    ]
]

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/install_skill.py (reported line 907)May include surrounding context.

python
_HARDCODED_SECRET_PATTERNS = [
    (re.compile(r'AKIA[A-Z0-9]{16}'), "AWS access key ID"),
    (re.compile(r'ghp_[A-Za-z0-9]{36,}'), "GitHub personal access token"),
    (re.compile(r'gho_[A-Za-z0-9]{36,}'), "GitHub OAuth token"),
    (re.compile(r'ghu_[A-Za-z0-9]{36,}'), "GitHub user-to-server token"),
    (re.compile(r'ghs_[A-Za-z0-9]{36,}'), "GitHub server-to-server token"),

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/scan_skill.py (reported line 180)May include surrounding context.

python
_HARDCODED_SECRET_PATTERNS = [
    (re.compile(r'AKIA[A-Z0-9]{16}'), "AWS access key ID"),
    (re.compile(r'ghp_[A-Za-z0-9]{36,}'), "GitHub personal access token"),
    (re.compile(r'gho_[A-Za-z0-9]{36,}'), "GitHub OAuth token"),
    (re.compile(r'ghu_[A-Za-z0-9]{36,}'), "GitHub user-to-server token"),
    (re.compile(r'ghs_[A-Za-z0-9]{36,}'), "GitHub server-to-server token"),

Static analysis

No suspicious patterns detected.