ClawHub
Back to skill

Security audit

ClawHub Publish

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly matches a ClawHub publishing workflow, but it includes personal-account and private record-keeping steps that are too specific and broad for a public publishing skill.

Review this before installing if you are not the original author. Replace the hardcoded account URL and C:\MAIBOT paths with your own values, remove the memory and Obsidian update steps unless you intentionally want them, and install the ClawHub CLI from a trusted source without administrator privileges where possible.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:12
Finding
Unpinned Global npm Dependency Installation## Vulnerability Details **File Location**: `SKILL.md`, line 12 **Vulnerability Type**: Supply-chain risk from an unpinned globally installed dependency **Risk Level**: Medium ### Vulnerable Code ```markdown - clawhub CLI installed: `npm i -g clawhub` ``` ### Technical Analysis The skill directs users to install the `clawhub` npm package globally without specifying an exact version, validating package provenance, checking package integrity, or using a lockfile. Consequently, the installed code can differ from the version that existed when the skill was audited. npm packages may execute lifecycle scripts during installation. A compromised or unexpectedly modified package release could therefore execute code with the installing user's privileges. Global installation also increases exposure by placing package executables and supporting files in shared user-level or system-level npm locations. This finding does not establish that the current `clawhub` package is malicious. The vulnerability is the mutable and insufficiently verified dependency installation process. ### Attack Path 1. An attacker compromises the referenced npm package, its publisher account, or its release process. 2. The attacker publishes a malicious package version containing hostile runtime behavior or installation lifecycle scripts. 3. A user follows the documented prerequisite and runs `npm i -g clawhub`. 4. npm retrieves the current mutable release rather than a previously reviewed version. 5. Malicious package code executes with the permissions of the user performing the installation. 6. The code may access local skill content, alter globally installed tooling, or target credentials and authenticated sessions available to that user. ### Impact Assessment Successful exploitation could provide arbitrary code execution with the installing user's privileges. The affected scope may include files readable or writable by that account, local skill source files, npm global installation dire ...[truncated 249 chars]
Remediation
## Remediation Suggestions - Pin the CLI to an exact reviewed version, for example `clawhub@X.Y.Z`, rather than installing the latest mutable release. - Document the package's authoritative registry location and verify the publisher and package provenance before installation. - Record and validate the expected package integrity digest where the distribution workflow supports it. - Prefer a project-local dependency governed by a committed lockfile over global installation. - If global installation is unavoidable, install from a non-elevated shell and document the minimum supported version. - Review npm lifecycle scripts and published package contents before approving upgrades. - Establish an explicit update process that re-audits new versions before changing the pinned version.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Self-Modification

High
Category
Rogue Agent
Content
### 2. Language & Sanitization Fix

If Korean or personal info is found:
1. Rewrite SKILL.md fully in English
2. Replace personal paths with generic placeholders (`$VAULT_PATH`, `~/vault`, `your-username`)
3. Move any `references/*.md` content to English as well
4. Write with UTF-8: `[System.IO.File]::WriteAllText($path, $content, [System.Text.Encoding]::UTF8)`
Confidence
95% confidence
Finding
The skill explicitly instructs rewriting SKILL.md and related reference files in place, which is a self-modification capability affecting agent instructions and behavior. Because the rewrite is broad ('Rewrite SKILL.md fully in English') and includes direct file-write guidance, it can unintentionally alter security-relevant instructions, erase safeguards, or propagate risky changes across additional files without strong validation.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The instructions require that the description field and SKILL.md content be rewritten fully in English, including moving referenced content to English. This imposes a language policy on the skill content without offering user opt-in or explaining a justified regional/compliance constraint.

Natural-Language Policy Violations

Medium
Confidence
97% confidence
Finding
The checklist requires the YAML description, SKILL.md body, reference files, headers, and comments to be fully in English and to contain no Korean text. This is a natural-language locale policy constraint applied categorically, with no opt-in choice or documented region-specific justification.

Natural-Language Policy Violations

Medium
Confidence
94% confidence
Finding
The embedded detection script is specifically used to identify and reject Korean text, which operationalizes the English-only rule. Because the file provides no user opt-in or clear external policy basis for this restriction, it falls under the locale policy violation category.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The checklist requires updating internal tracking artifacts (`memory/marketplace-strategy.md` and Obsidian `_DASHBOARD.md`) that are unrelated to the generic act of publishing a skill. This can cause the agent to disclose workspace structure, modify unrelated files, or couple an external publishing workflow to private operational systems, increasing the chance of unintended data exposure or unauthorized side effects.

Context-Inappropriate Capability

Low
Confidence
88% confidence
Finding
The manifest describes a skill for preparing and publishing skills to the ClawHub marketplace, including sanitization, versioning, and CLI publish. However, the documented workflow also requires modifying `C:\MAIBOT\memory\marketplace-strategy.md` and an Obsidian dashboard, which are separate personal/project record-keeping actions not necessary for the publish operation itself.

Context-Inappropriate Capability

Low
Confidence
82% confidence
Finding
The checklist hardcodes a personal profile URL (`https://clawhub.ai/u/jini92`) as a verification step, which leaks identity-specific information and makes the skill less generic than advertised. In a publishing automation context, this can direct agents or users toward the wrong account and unnecessarily expose personal association details.

Static analysis

No suspicious patterns detected.