ClawHub
Back to skill

Security audit

Skill Router Pro

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed skill-discovery helper that reads and indexes local skill metadata, with some privacy and persistence considerations but no evidence of deception or unsafe behavior.

Install only if you are comfortable with an agent reading local skill metadata from several common skill directories and maintaining a persistent skill index. Review the generated INDEX.md if local paths or installed capability names are sensitive in your environment.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
94% confidence
Finding

The skill instructs scanning multiple agent and editor configuration directories, including ~/.openclaw, ~/mind_claw, ~/.codex/skills, and ~/.cursor/skills-cursor. Access to these directories can reveal installed capabilities, local paths, and potentially sensitive agent configuration details beyond what is necessary for a simple skill lookup.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

After installing any new skill, rescan and update the index:

text
find ~/.openclaw/skills ~/mind_claw ~/.codex/skills ~/.cursor/skills-cursor -name "SKILL.md" 2>/dev/null

Extract name and description from each SKILL.md frontmatter, then write to

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The invocation guidance overlaps with normal task execution because it says to check this skill before building anything new and includes generic phrases like 'what skill should I use'. That ambiguity can make the router run in contexts where another skill should handle the request directly, creating misrouting and avoidable exposure to local skill metadata and ClawHub queries.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger phrases are broad enough that this routing skill could activate for many generic requests about skills, causing it to intercept tasks that should go directly to a more specific skill. In an agent system, over-broad routing increases the chance of unintended tool use and unnecessary access to local files or external search commands.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
92% confidence
Finding

Enumerating all SKILL.md files across several local directories exposes a catalog of installed skills, paths, and ecosystem layout. That information can aid follow-on attacks by revealing available automation capabilities and local environment structure.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

After installing any new skill, rescan and update the index:

text
find ~/.openclaw/skills ~/mind_claw ~/.codex/skills ~/.cursor/skills-cursor -name "SKILL.md" 2>/dev/null

Extract name and description from each SKILL.md frontmatter, then write to

Session Persistence

Medium
Category
Rogue Agent
Confidence
90% confidence
Finding

Writing to ~/.openclaw/skills/INDEX.md introduces persistent session state that survives the current interaction. Persistent agent-managed files can become stale, can be modified without the user's awareness, and may influence future routing behavior in ways that are difficult to audit.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

find ~/.openclaw/skills ~/mind_claw ~/.codex/skills ~/.cursor/skills-cursor -name "SKILL.md" 2>/dev/null

text

Extract name and description from each SKILL.md frontmatter, then write to
`~/.openclaw/skills/INDEX.md` with this format:

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

md
## Never Do This

- Do not assume a skill exists without checking
- Do not suggest building when ClawHub has one
- Do not leave INDEX.md stale after new installs
- Do not guess — show the index and let the user verify

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The instructions direct the agent to update a user-owned index file without clearly calling out that this is a persistent filesystem write. Silent writes to configuration or inventory files can surprise users, create integrity issues, and normalize state changes without consent.

Content

No source excerpt is available for this finding.