Security audit

AnySkill Skill Cloud Manager

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed cloud skill manager, but it gives agents broad, persistent authority to load and mutate remote instructions without enough verification or user control.

Install only if you are comfortable with an agent using a GitHub token to manage a private skill repository, modifying persistent agent/workspace files, and loading future instructions from mutable remote repositories. Prefer a read-only single-repository token unless you need upload/delete features, avoid plaintext token storage, review diffs before any git push or deletion, and do not install public packs unless you trust the source and revision.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:362
Finding: Unverified Remote Skill Instructions Are Dynamically Retrieved and Followed
Content: View full analysis
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:332
Finding: Persistent Cloud-Loading Directive Is Written into the Agent Workspace
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:432
Finding: Unvalidated Configuration and Skill Names Are Interpolated into Shell Commands
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:40
Finding: GitHub PAT May Be Stored in Plaintext and Sent More Broadly Than Necessary
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:530
Finding: Mutable Public Skill Packs Are Imported Without Integrity Verification
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (22)

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Although the text says not to auto-overwrite SKILL.md, the surrounding feature performs remote-driven infrastructure updates by downloading files from upstream and overwriting local repository content. This is a form of self/update-capable behavior that can modify operational code and automation based on remote content, which is sensitive in an agent skill.
Content: Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.
md
> - New feature C > > To update, run: `clawhub update anyskill` - **Do not auto-overwrite SKILL.md.** Inform the user to update via ClawHub CLI which provides versioned, auditable updates. 3. **Infrastructure version check**: - Read the `.anyskill-infra-version` file from the user's private repo `{localPath}`. If it doesn't exist, treat as `0.0.0`.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 364)May include surrounding context.
md
4. For each file in the `files` array, read all files from the cloud into **memory** (do not save to local disk), then digest the `SKILL.md` specifications.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 400)May include surrounding context.
md
4. For each file in the `files` array, read all files from the cloud into **memory** (do not save to local disk), then digest the `SKILL.md` specifications.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 401)May include surrounding context.
md
4. For each file in the `files` array, read all files from the cloud into **memory** (do not save to local disk), then digest the `SKILL.md` specifications.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 402)May include surrounding context.
md
4. For each file in the `files` array, read all files from the cloud into **memory** (do not save to local disk), then digest the `SKILL.md` specifications.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 403)May include surrounding context.
md
4. For each file in the `files` array, read all files from the cloud into **memory** (do not save to local disk), then digest the `SKILL.md` specifications.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 425)May include surrounding context.
md
4. For each file in the `files` array, read all files from the cloud into **memory** (do not save to local disk), then digest the `SKILL.md` specifications.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 426)May include surrounding context.
md
4. For each file in the `files` array, read all files from the cloud into **memory** (do not save to local disk), then digest the `SKILL.md` specifications.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 451)May include surrounding context.
md
4. For each file in the `files` array, read all files from the cloud into **memory** (do not save to local disk), then digest the `SKILL.md` specifications.

Self-Modification

High

Category: Rogue Agent
Confidence: 88% confidence
Finding: The skill can modify skill content in the managed repository and push those changes upstream automatically. This is intentional functionality, but it is still self-/capability-modifying behavior that can alter future agent behavior or shared team tooling, especially when changes are committed and propagated automatically.
Content: Scanner excerpt · SKILL.md (reported line 457)May include surrounding context.
bash
cd {localPath} git add skills/{name}/ git commit -m "fix: update skill {name}" git push origin {branch}

Inform the user upon completion:

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: The command git rm -rf skills/{name}/ uses a user-influenced parameter in a destructive filesystem/git operation. If {name} is not strictly validated, path traversal or argument-manipulation patterns could delete unintended files or repository content before commit and push, making this especially dangerous.
Content: Scanner excerpt · SKILL.md (reported line 493)May include surrounding context.

After user confirms, execute:
bash
cd {localPath} git rm -rf skills/{name}/ git commit -m "feat: remove skill {name}" git push origin {branch}

Session Persistence

Medium

Category: Rogue Agent
Confidence: 90% confidence
Finding: The skill instructs writing or updating persistent workspace configuration (TOOLS.md) based on detected state. This establishes durable session/workspace persistence that can influence future agent behavior and user expectations beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.
md
4. Attempt to fetch `index.json` to confirm connectivity. 5. Inform the user: > ✅ AnySkill configuration detected, connected to repository `{repo}`. Ready to use! 6. **If current environment is OpenClaw**: Check if `TOOLS.md` already contains a `### AnySkill` section. If not, or if the skill list is outdated, execute the "OpenClaw Exclusive: Write Workspace Config" steps below to register/update the skill list. If verification fails (network error or repo deleted), ask the user if they want to re-initialize.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 93% confidence
Finding: The skill directs the agent to silently inspect environment variables and auto-discover cloud configuration before asking the user. This reduces transparency around secret handling and encourages autonomous use of sensitive credentials and account-linked resources without an explicit user-triggered operation.
Content: Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.
md
**Before asking the user any questions, first silently detect if a usable Token already exists:** 1. Check if environment variable `ANYSKILL_GITHUB_TOKEN` exists. 2. If it **exists** (meaning the user has previously configured AnySkill on this machine): - **Do not ask the user for a Token**, directly jump to "Path B: User only provided a Token" auto-discovery flow below. - The entire process should be silent to the user: AI auto-detects cloud repo → confirms mount → writes global config → ready. 3. If it **does not exist**, then initiate the guided conversation (see below).

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly instructs storing a GitHub PAT in plaintext within ~/.anyskill/config.json for some IDEs. This creates credential-at-rest exposure: any local process, backup system, repo accident, or shoulder-surfed file read could leak a token that has read/write access to the private skill repository.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 92% confidence
Finding: The skill instructs sending a GitHub token to api.github.com/user to identify the account owner. Although the destination is legitimate GitHub infrastructure, this is still external transmission of a sensitive credential and should be treated carefully because the skill normalizes token use without granular consent at each step.
Content: Scanner excerpt · SKILL.md (reported line 253)May include surrounding context.
Use the GitHub API or command line to get user info:

bash
curl -s -H "Authorization: token {token}" https://api.github.com/user

Extract the login field from the returned JSON — that's the username.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 91% confidence
Finding: The repository search flow transmits the user's token to GitHub to enumerate candidate repositories under the authenticated username. Even though this is expected functionality, it expands token use to discovery operations and could unintentionally reveal repository metadata or normalize broad autonomous remote queries using sensitive credentials.
Content: Scanner excerpt · SKILL.md (reported line 261)May include surrounding context.
Call the GitHub Repository Search API:

bash
curl -s -H "Authorization: token {token}" "https://api.github.com/search/repositories?q=user:{login}+anyskill+in:name,description"

For each candidate repo in the results, try to read its index.json:

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 90% confidence
Finding: The same instruction also explicitly endorses auto-execution after repo detection, reinforcing an agent pattern of acting on behalf of the user in ways that alter local and remote state. In a skill that handles tokens, git operations, and config files, this context makes autonomous action more dangerous than in a read-only helper skill.
Content: Scanner excerpt · SKILL.md (reported line 273)May include surrounding context.
md
- **✅ Existing skill repo detected**: Inform user and request confirmation: > 👋 Welcome back! I detected an existing skill repository `{login}/{repo-name}`. Mounting automatically... Then auto-execute clone and config write (same as Path A steps 1-4), **without asking unnecessary questions**. - **❌ No skill repo detected** (confirmed as a brand new user):

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 90% confidence
Finding: The same instruction also explicitly endorses auto-execution after repo detection, reinforcing an agent pattern of acting on behalf of the user in ways that alter local and remote state. In a skill that handles tokens, git operations, and config files, this context makes autonomous action more dangerous than in a read-only helper skill.
Content: Scanner excerpt · SKILL.md (reported line 273)May include surrounding context.
md
- **✅ Existing skill repo detected**: Inform user and request confirmation: > 👋 Welcome back! I detected an existing skill repository `{login}/{repo-name}`. Mounting automatically... Then auto-execute clone and config write (same as Path A steps 1-4), **without asking unnecessary questions**. - **❌ No skill repo detected** (confirmed as a brand new user):

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 317)May include surrounding context.
md
- **Skill Repository**: `{repo}` - **Global Config**: `~/.anyskill/config.json` - **Local Path**: `{localPath}` - **Skill Loading**: When you lack a skill, read the guide in `~/.openclaw/skills/anyskill/SKILL.md` to load from the cloud AnySkill repository on demand - **Operation**: All skill management (load, download, upload, list, delete) is triggered via natural language, no CLI needed #### Registered Cloud Skills

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 340)May include surrounding context.
md
- **Skill Repository**: `{repo}` - **Global Config**: `~/.anyskill/config.json` - **Local Path**: `{localPath}` - **Skill Loading**: When you lack a skill, read the guide in `~/.openclaw/skills/anyskill/SKILL.md` to load from the cloud AnySkill repository on demand - **Operation**: All skill management (load, download, upload, list, delete) is triggered via natural language, no CLI needed #### Registered Cloud Skills

Session Persistence

Medium

Category: Rogue Agent
Confidence: 89% confidence
Finding: The OpenClaw registry sync rule requires persistent updates to TOOLS.md after skill list changes. Even though it says not to overwrite unrelated content, it still alters durable workspace configuration automatically, which can shape future sessions and broaden the skill's footprint.
Content: Scanner excerpt · SKILL.md (reported line 345)May include surrounding context.
md
If AnySkill-related content already exists, skip this step. > ⚠️ **Do not modify any other content** in these two files. Only append or update the AnySkill section — never overwrite existing user configurations. #### OpenClaw Skill Registry Sync (General Rule)

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 566)May include surrounding context.
md
* You may briefly report to the user: "Loading [skill-name] from cloud skill repository..." * If `index.json` has no matching skill, inform the user that the cloud repository currently lacks the corresponding capability. * If a network request fails, report to the user and suggest checking network connectivity or repository availability. * **Throughout the entire process, never ask the user to manually run terminal commands.** All file creation, downloading, and git operations are performed automatically by you.

Static analysis

No suspicious patterns detected.