Axiomata Skill Forge

• Outcome: Review
• Latest audit: May 28, 2026 · 9:53 AM UTC
• Version: 1.0.1

Overview

This skill is for creating and publishing other skills, but it gives broad publishing and file-mutation guidance without enough guardrails or disclosure.

Install only if you intentionally want a skill-authoring and ClawHub-publication workflow. Review generated skills before publishing, protect CLAWHUB_TOKEN, avoid running the included tests in an important skills directory until cleanup is constrained, and remove the cluster-specific loyalty/alignment requirements if the output is meant for general users.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# Clean up if exists
    skill_dir = os.path.join(skills_path, test_skill)
    if os.path.exists(skill_dir):
        subprocess.run(["rm", "-rf", skill_dir], capture_output=True)
    
    # Initialize
    script = "/mnt/Morgana/skills/axiomata-skill-forge/scripts/init_skill.py"

• Confidence: 88% confidence
• Finding: subprocess.run(["rm", "-rf", skill_dir], capture_output=True)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if result.returncode == 0 and os.path.exists(skill_dir):
        print(f"  ✅ {test_skill} initialized")
        # Clean up
        subprocess.run(["rm", "-rf", skill_dir], capture_output=True)
        return True
    else:
        print(f"  ❌ Failed: {result.stderr}")

• Confidence: 88% confidence
• Finding: subprocess.run(["rm", "-rf", skill_dir], capture_output=True)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill clearly instructs use of shell commands and external CLIs, yet it declares no permissions or capability boundaries. That makes the skill's execution surface opaque to users and downstream policy systems, increasing the risk of unintended command execution, filesystem changes, and network publishing without informed consent.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The documentation promises mandatory gating, auto-improvement, governance controls, and publication behavior that are not actually implemented or enforced locally. This is dangerous because users may rely on claimed safeguards that do not exist, leading to publication of low-quality or unsafe skills and misplaced trust in fictional controls.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The file claims 'safe file operations' and 'no data leak' while also documenting remote publication to ClawHub and use of a publishing token. That contradiction can mislead users into exposing skill contents or metadata externally without appreciating that data transmission and credential use are occurring.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: The trigger phrases are generic enough to match common authoring requests such as creating or improving a skill. Broad triggers increase the chance of unintended activation of a skill that can write files, run evaluation tooling, and publish artifacts, which expands risk through accidental invocation.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The publication workflow references use of an API token and remote publishing but provides no warning about credential handling, destination trust, or data exposure. This can lead operators to paste secrets into unsafe environments or publish sensitive content without understanding the security implications.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Listing CLAWHUB_TOKEN as an environment variable without any caution normalizes unsafe secret handling. Users may expose the token in shell history, logs, process listings, or screenshots, enabling unauthorized publication or account abuse.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.