Security audit

Test Clone

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent ClawHub CLI helper, but it includes unpinned global installation and bulk forced update guidance that can change installed agent skills with little user review.

Review the target directory before publishing, avoid publishing folders that may contain secrets, prefer updating a single named skill first, and do not use bulk forced noninteractive updates unless you intentionally want multiple installed skills changed. Install the CLI from a trusted registry and prefer a pinned reviewed version where possible.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:23
Finding: Unpinned Global Installation of a Third-Party npm Package
Content: View full analysis
Remediation: View remediation
``` 2. Specify and validate the trusted npm registry rather than relying on an arbitrary user-configured registry. 3. Publish and verify expected package integrity information or provenance where the installation workflow supports it. 4. Prefer a project-local installation over a global installation to reduce system-wide exposure. 5. Use a lockfile or another reproducible dependency mechanism when integrating the CLI into an automated project workflow. 6. Disable npm lifecycle scripts during installation when compatible with the package, and explicitly review any scripts that must run. 7. Document package publisher and provenance verification steps before installation or execution. 8. Run the CLI with least privilege and avoid installation through an administrator or root account. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The auth and publish instructions tell the user to log in and publish a skill to a remote service but do not warn that credentials will be used and that local skill contents may be transmitted externally. In an agent workflow, this can lead to accidental disclosure of proprietary code, secrets embedded in skill folders, or unintended publication under the user's account.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill explicitly presents bulk and forced update commands such as clawhub update --all --no-input --force without any caution about mass changes, non-interactive execution, or the risk of replacing many installed skills at once. In an agent context, this increases the chance of unintended upgrades, compatibility breakage, or silent installation of changed skill behavior from a remote registry.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.