ClawHub
Back to skill

Security audit

SkillNote Doctor

Security checks for vulnerabilities and agentic risk

Overview

This skill is a read-only diagnostic checklist for SkillNote/OpenClaw setup, with some caution needed around broad triggers and install advice.

Install this only if you use SkillNote/OpenClaw and are comfortable with a diagnostic skill reading those configuration files and contacting the configured SkillNote host. Verify ClawHub/npm package sources before following installation commands, especially global npm installation.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:17
Finding

Unpinned Third-Party Package Installation Instructions

Content
View full analysis
SkillNote not detected. Install with: > ``` > clawhub install skillnote > clawhub install skillnote-resolver ``` ### Technical Analysis The diagnostic instructions recommend installing `clawhub`, `skillnote`, and `skillnote-resolver` without specifying trusted versions, immutable source revisions, cryptographic checksums, or signature-verification procedures. In particular, `npm install -g clawhub` retrieves the currently resolved package release and may execute npm lifecycle scripts with the privileges of the invoking user. The global installation scope can also expose the package to a broad set of subsequent user operations. The `clawhub install` commands similarly identify packages only by mutable names, without documenting an integrity boundary for the downloaded artifacts. No evidence establishes that the referenced packages are currently malicious. The risk arises because the proposed remediation trusts mutable third-party registry content. A compromised publisher account, package registry, release pipeline, or malicious ...[truncated 1604 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifest trigger phrases are very broad (for example, "debug", "broken", and "not working") and are likely to activate during ordinary troubleshooting conversations unrelated to this specific skill. Over-broad invocation increases the chance the skill is selected unexpectedly, causing unnecessary environment inspection and network probing against a configured host.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

md
## Check 5 — skillnote-resolver installed

Check `~/.openclaw/skills/skillnote-resolver/SKILL.md` exists.

- ✓ Pass: file found
- ✗ Fail: `skillnote-resolver not found. Install with: clawhub install skillnote-resolver`

Static analysis

No suspicious patterns detected.