Skill 发布与 GitHub 托管

• Outcome: Review
• Latest audit: Sep 21, 2026 · 2:09 PM UTC
• Version: 1.0.0

Overview

The skill is mostly coherent for publishing ClawHub skills, but its login helper disables HTTPS certificate checks while handling and saving a read/write access token.

Review before installing. Do not use the bundled device-login helper unless TLS verification is fixed; otherwise a network attacker could intercept or tamper with the login flow. Treat ClawHub tokens as passwords, avoid printing them in shared logs or screenshots, and confirm before any publish, GitHub push, hide, or delete action.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/clawhub_device_login.py:26

Finding

Disabled TLS Verification Exposes Device Authentication Tokens to Interception

Content

View full analysis

Vulnerability Details

File Location: scripts/clawhub_device_login.py, lines 26–28, with the insecure context used at lines 40 and 53
Vulnerability Type: Improper TLS certificate and hostname validation
Risk Level: High

Complete Code Snippet

python

ctx = ssl.create_default_context()
ctx.check_hostname = False
ctx.verify_mode = ssl.CERT_NONE

The resulting context is used for both POST and GET requests:

python

with urllib.request.urlopen(req, timeout=30, context=ctx) as r:
    return r.status, json.loads(r.read().decode("utf-8", "ignore"))

python

with urllib.request.urlopen(req, timeout=30, context=ctx) as r:
    return r.status, json.loads(r.read().decode("utf-8", "ignore"))

The affected requests include service discovery and the device authorization flow:

python

site = os.environ.get("CLAWHUB_SITE", "https://clawhub.ai")
api_base, auth_base = discover(site)
registry = api_base or site
payload = {"scope": "read write", "site_url": auth_base, "label": "WorkBuddy CLI (agent)"}
st, body = post(registry.rstrip("/") + "/api/cli/device/code", payload)

python

st, body = post(url, {"device_code": device_code, "grant_type": GRANT})
if st == 200 and body.get("access_token"):
    token = body["access_token"]

Technical Analysis

The script explicitly disables both certificate-chain verification and hostname verification for every HTTPS request made through its shared SSL context. HTTPS therefore provides encryption without authenticated server identity.

This affects:

• Registry discovery through /.well-known/clawhub.json or /.well-known/clawdhub.json
• Device-code requests
• Device-token polling
• Responses containing the eventual read/write access token

Because discovery responses can supply apiBase or registry, an intercepted response can also redirect subsequent authentication requests to an attacker-selected endpoint ...[truncated 1582 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the insecure TLS overrides:

   python

   ctx = ssl.create_default_context()
   

   Do not set check_hostname to False or verify_mode to ssl.CERT_NONE.

2. Require all configured and discovered endpoints to use HTTPS.

3. Validate discovery results before use. By default, require apiBase, registry, and authBase to remain on the expected trusted origin. Any cross-origin registry should require explicit user authorization and an allowlisted trusted host.

4. Fail closed on certificate errors rather than retrying with disabled verification.

5. Avoid persisting authentication state when endpoint validation fails. If a token may have been exchanged over an unauthenticated connection, revoke it and require a new device authorization.

6. Add tests confirming that self-signed certificates, hostname mismatches, expired certificates, and untrusted discovery redirects are rejected.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The description presents a comprehensive 'publish skill' utility spanning ClawHub distribution and GitHub hosting. The actual code chunk is a single-purpose authentication helper for ClawHub device-flow login. While sandbox login is mentioned in the declared description, this code does not implement the primary advertised workflow of publishing or GitHub synchronization. Therefore the description does not accurately represent what this code chunk actually does; it reflects only one supporting subcomponent of the broader claimed functionality.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The description presents a broad 'publish skill' tool centered on distributing a skill to ClawHub and GitHub. In contrast, the code chunk only fixes a specific Git issue on Windows by manually creating remote-tracking ref files and setting upstream tracking for an existing repository. While the description mentions Windows/work-sandbox environment pitfalls, this script is not a publishing workflow component by itself; its primary purpose is unrelated Git maintenance. There is no ClawHub interaction, no GitHub repository creation or push logic, no content checks, and no publishing commands. Therefore the code does not accurately represent the declared purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly recommends a command that prints the stored ClawHub access token, but it does not prominently warn that this reveals a reusable credential. Exposing tokens in terminal output, logs, transcripts, or screenshots can lead directly to account compromise and unauthorized publication or modification of skills.

Content

No source excerpt is available for this finding.

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · SKILL.md (reported line 480)May include surrounding context.

python

import os, subprocess
env = os.environ.copy()
for k in ("http_proxy", "https_proxy", "HTTP_PROXY", "HTTPS_PROXY"):
    env[k] = "http://127.0.0.1:7897"
subprocess.run(["git", "-C", REPO, "push"], capture_output=True, env=env)

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script disables both TLS certificate validation and hostname verification for all HTTPS requests used in device-flow discovery and token exchange. That allows a man-in-the-middle attacker to impersonate the ClawHub service, tamper with discovery responses, steal device codes or access tokens, and redirect authentication traffic to attacker-controlled endpoints.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Certificate and hostname verification are explicitly turned off during authentication-related network calls, which defeats HTTPS protections at the most sensitive point in the workflow. In this skill context, the script handles OAuth device login and writes tokens for later publishing, so compromised transport can directly lead to account takeover or unauthorized publication under the user's identity.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill documents extensive use of shell, network, filesystem writes, and environment manipulation, but it declares no explicit tool scope or permission boundaries. In an automation skill that performs publishing, login, token storage, and Git/GitHub operations, missing permission declarations increase the chance of overbroad execution and make it harder for users or the platform to understand and constrain what the skill can do.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger phrases are broad enough to match generic requests like publishing, uploading to GitHub, or creating a repository, which can cause the skill to activate outside its intended context. In a skill that includes login flows, token handling, publishing, and push/delete operations, over-triggering raises the risk of unintended sensitive or destructive actions being proposed or executed.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 364)May include surrounding context.

powershell

$env:PATH = "C:\Program Files\Git\cmd;C:\Program Files\GitHub CLI;" + $env:PATH
Push-Location <本地目录>
gh repo create <repo> --public --source=. --remote=origin --push --description "<ASCII 描述的更稳>"
Pop-Location

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 364)May include surrounding context.

powershell

$env:PATH = "C:\Program Files\Git\cmd;C:\Program Files\GitHub CLI;" + $env:PATH
Push-Location <本地目录>
gh repo create <repo> --public --source=. --remote=origin --push --description "<ASCII 描述的更稳>"
Pop-Location

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill advertises a delete command alongside other quick-reference commands without any warning, confirmation guidance, or distinction between reversible and irreversible effects. Users may invoke deletion casually while following the recipe, causing accidental removal or hiding of published assets.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The code stores the retrieved access token in %APPDATA%/clawhub/config.json, which is a sensitive file write involving credentials. While the top-level docstring mentions that the token is written to config.json, the runtime behavior provides no confirmation or warning before persisting the credential to disk.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/fix_git_upstream.py (reported line 33)May include surrounding context.

python

def git(args, cwd):
    """统一入口：内部固定加 'git'，避免调用处漏写。"""
    p = subprocess.run(["git"] + args, capture_output=True, cwd=cwd)
    return (
        p.returncode,
        p.stdout.decode("utf-8", "replace").strip(),

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The instruction says to '补英文触发词' as a requirement, which imposes a language policy in the skill guidance. The file does not frame this as optional based on user preference or clearly justify why English must be included for every case.

Content

No source excerpt is available for this finding.