ClawHub
Back to skill

Security audit

Skillguard

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed remote security-audit helper, but its installer can change the local skill environment based on an incomplete remote audit and includes an audit-bypass path.

Review before installing. Use the audit command only for code you are comfortable sending to the SkillGuard API, avoid submitting proprietary or secret-bearing files, and do not rely on safe-install.sh as a complete pre-install guarantee because it can skip audits and does not verify that the installed artifact is exactly the one audited.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
audit.sh:51
Finding

Incomplete and Non-Atomic Pre-Installation Security Audit

Content
View full analysis
/dev/null) || { echo "❌ Could not fetch skill '$VALUE' from ClawHub" exit 1 } # Collect code from SKILL.md and any .sh/.js/.py/.ts files code="" for fname in SKILL.md $(echo "$files" | jq -r '.files[]?.path // empty' 2>/dev/null | grep -E '\.(sh|js|ts|py|md)$'); do content=$(clawhub inspect "$VALUE" --file "$fname" 2>/dev/null) || continue ``` The file collection loop concludes at `audit.sh:62`: ```bash code+="--- FILE: $fname ---"$'\n'"$content"$'\n\n' done ``` After a safe verdict, `safe-install.sh:124-128` performs a new name-based installation: ```bash SAFE|LOW_RISK) echo -e "✅ Skill looks safe. Installing..." echo "" exec clawhub install "$SKILL" ;; ``` ### Technical Analysis The security decision does not cover the complete artifact that is subsequently installed: 1. The extension filter only includes `.sh`, `.js`, `.ts`, `.py`, and `.md` files. 2. Extensionless executables, binaries, configuration files, package lifecycle definitions, and files using other script extensions are omitted. 3. Failure to retrieve an individual selected file is silently ignored through `|| continue`, so the audit can proceed with incomplete input. 4. The audit and installation are separate ClawHub operations identified only by the skill name. 5. No immutable version, artifact digest, or signature binds the audited contents to the installed contents. Consequently, a ...[truncated 1825 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The description frames the skill as a security audit helper, but its documented behavior includes fetching remote content, reading local files, and transmitting full source code to a third-party API. That mismatch is risky because users may treat it as a simple local analyzer while it actually exfiltrates potentially sensitive code and depends on external tools and network access.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding

The skill declares shell-capable behavior through documented bash usage and required binaries, but it does not declare any explicit tool scope or permissions. This creates a transparency and governance gap: an installer or agent may approve the skill without understanding that it can invoke local commands, inspect skills, and handle file content.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

The skill explicitly sends the full source code of the audited skill to an external API endpoint. Even with a privacy notice, this is a real security concern because uploaded code may contain secrets, proprietary logic, internal URLs, or other sensitive content that leaves the local trust boundary.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md
Audit any OpenClaw skill for security risks **before** you install it.

Calls the SkillGuard API (`https://api.agentsouls.io/api/audit`) and returns a verdict, risk score, and threat list.

## Usage

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · audit.sh (reported line 4)May include surrounding context.

sh
#!/usr/bin/env bash
set -euo pipefail

API_URL="https://api.agentsouls.io/api/audit"

usage() {
  echo "Usage: audit.sh --name <skill-slug> | --code <file>"

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

This POST request exfiltrates the provided code payload to an external domain for auditing. Even if this is the intended product behavior, it is still security-relevant because the uploaded content may contain secrets, private source code, or untrusted material fetched from ClawHub, and the user is not forced through an informed-consent step.

Content

Scanner excerpt · audit.sh (reported line 19)May include surrounding context.

sh
local code="$1"
  local source="${2:-local}"

  response=$(curl -sf -X POST "$API_URL" \
    -H "Content-Type: application/json" \
    -d "$(jq -n --arg code "$code" --arg source "$source" \
      '{code: $code, source: $source}')" 2>&1) || {

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script sends the full contents of a local file or fetched skill code to a third-party remote API for analysis, but it does not provide a clear consent prompt, redaction step, or prominent warning that code will leave the local environment. This creates a real confidentiality risk because users may unknowingly transmit proprietary code, secrets, or sensitive skill contents to an external service.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The wrapper explicitly supports a --force path that bypasses the security audit and directly executes clawhub install, undermining the core security promise of a 'safe install' mechanism. In practice, this creates an easy opt-out from the control, allowing risky or malicious skills to be installed without any review when a user is convinced or instructed to use the flag.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The comment itself is not the root issue, but it documents and normalizes an intentional audit bypass in a tool whose purpose is to enforce pre-install screening. In this context, the documented bypass makes the surrounding unsafe behavior easier to discover and use, reinforcing a real security weakness rather than being harmless documentation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.