Clawhub Top

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:13 PM UTC
• Version: 1.0.0

Overview

The skill mostly fetches ClawHub rankings, but it also describes unattended daily Telegram notifications without clear setup or consent and uses shell-based command execution in helper scripts.

Review before installing. It appears to be a local ClawHub marketplace ranking reporter, with no evidence of credential theft, destructive file changes, or hidden remote payloads. The main concern is that the skill text asks for daily Telegram notification behavior without a clear opt-in setup or implementation, and the helper scripts should avoid shell=True before being trusted in a sensitive environment.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The overall domain is related—this is a ClawHub rankings/reporting script—but the declared description does not accurately match the implemented behavior in key areas. The code does support popular skills and trending skills, but it does not retrieve newly released skills at all. Instead, it fetches recent downloads and rating-based rankings. It also does not implement any daily auto-notification mechanism. Additionally, the script includes a rating leaderboard that is not mentioned in the description. Therefore the description is only partially accurate and should be flagged as a mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence
• Finding: Most of the declared description matches the code: it retrieves and displays top popular skills, newest skills, and trending skills from ClawHub. However, the description also states 'Daily auto-notification of industry trends,' which is not supported by this code chunk. There are no triggers, schedulers, background jobs, notification APIs, or messaging behaviors implemented—only immediate console output when the script is run. Therefore this is a partial but material description-behavior mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The code largely relates to ClawHub rankings, so the general domain is accurate, but the declared description does not fully match actual behavior. The script retrieves top 20 lists by total installs/downloads, rating, and trending. However, it never queries or displays newly released skills, despite that being a stated use case. It also contains no scheduling, triggers, or notification mechanism for daily trend alerts. Additionally, it includes a top-20-by-rating report, which is not mentioned in the declared description. This is a material description/behavior mismatch rather than a harmless implementation detail.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

from datetime import datetime

def run_cmd(cmd):
    result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
    output = result.stdout + result.stderr
    lines = output.strip().split('\n')
    filtered = [l for l in lines if not l.startswith('- Fetching')]

• Confidence: 95% confidence
• Finding: Using subprocess.run with shell=True is a classic parameter-abuse pattern because the shell interprets the command string and introduces risks not needed for the stated functionality. Even with hardcoded strings, this is more dangerous in an agent skill context because runtime environment manipulation, command shadowing via PATH, or later interpolation of user-controlled values could lead to arbitrary command execution.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

import textwrap

def run_cmd(cmd):
    result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
    output = result.stdout + result.stderr
    lines = output.strip().split('\n')
    filtered = [l for l in lines if not l.startswith('- Fetching')]

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly describes sending scheduled results to Telegram, an external third-party destination, but provides no user-facing warning, consent flow, or disclosure about that outbound data transmission. Even if the data is only trend information, silent exfiltration to an external messaging service creates a privacy and governance risk, especially in environments where automation may run unattended.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The manifest advertises 'Daily auto-notification of industry trends,' but this file is only an interactive reporting script that prints rankings to stdout. There is no scheduling, persistence, notification delivery, or automation mechanism present here.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The manifest claims the skill can show 'top 20 newly released skills,' but the code only queries installsAllTime, downloads, rating, and trending sorts. There is no logic here to retrieve or display latest/newly released skills, so the implemented behavior does not match the described capability.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: This code contains multiple user-facing strings in Chinese, including the module description and all runtime status/output text, but provides no option for the user to select another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly justified.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: This skill performs external command execution to obtain rankings, giving it broader execution capability than a simple data/reporting helper appears to require. In this context the behavior is likely functional rather than malicious, but it still increases trust and attack surface because the skill depends on whatever 'clawhub' binary is present in the runtime environment.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

from datetime import datetime

def run_cmd(cmd):
    result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
    output = result.stdout + result.stderr
    lines = output.strip().split('\n')
    filtered = [l for l in lines if not l.startswith('- Fetching')]

• Confidence: 94% confidence
• Finding: The script executes shell commands with shell=True, which unnecessarily invokes a shell and expands the attack surface beyond simple command execution. Although the current command strings are hardcoded and there is no direct user input in this file, using a shell for a reporting skill is risky because environment/path manipulation, shell metacharacter handling, or future code changes could turn this into command injection or unexpected command execution.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The file presents user-facing text in Chinese, including the description and later status/output strings, without offering any language selection or documenting a region-specific requirement. This creates a language policy issue because the skill effectively forces a specific locale for users regardless of preference.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

import textwrap

def run_cmd(cmd):
    result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
    output = result.stdout + result.stderr
    lines = output.strip().split('\n')
    filtered = [l for l in lines if not l.startswith('- Fetching')]

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The printed labels and descriptions are hard-coded in Chinese for downloads, installs, ratings, comments, and summaries. Since the script does not offer a user-selectable language or explain a required locale, it violates the natural-language policy criterion on forced language choice.

Natural-Language Policy Violations

Low

• Confidence: 97% confidence
• Finding: The script includes user-facing comments and terminal output in Chinese, such as the headings and completion message, with no indication that Chinese is optional or that the skill is intended only for a Chinese-speaking or region-specific audience. This creates a natural-language locale policy concern because it imposes a specific language on all users without opt-in.

Description-Behavior Mismatch

Low

• Confidence: 95% confidence
• Finding: The manifest says the skill is for popular rankings by downloads, newly released skills, trending skills, and daily trend notifications. This script adds a separate 'Top 20 (按评分)' / rating-sorted view, which is an additional behavior not mentioned in the stated skill scope.