Kinema's Skill Making Pipeline

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:56 AM UTC
• Version: 1.11.0

Overview

The skill is a coherent publishing workflow, but some fallback and troubleshooting steps can upload sensitive local files or delete agent cache directories without enough user confirmation.

Install only if you want an agent to help manage skill releases across GitHub, ClawHub, Claude Code, and Codex. Before using the ClawHub API fallback, review the exact files to be uploaded and exclude .env, credentials, tokens, local config, and private datasets. Do not run the cache cleanup or sudo/global install examples unless you have confirmed the resolved paths and explicitly approve the action.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: references/clawhub-api-fallback.md:24

Finding

Overbroad ClawHub fallback upload can disclose repository secrets

Content

View full analysis

', displayName: '', version: '1.2.0', changelog: 'description of changes', acceptLicenseTerms: true, tags: ['latest'] })); for (const f of files) form.append('files', new Blob([f.bytes], {type: 'text/plain'}), f.relPath); fetch('https://clawhub.ai/api/v1/skills', { method: 'POST', headers: { 'Authorization': 'Bearer ' + TOKEN, 'Accept': 'application/json' }, body: form }) ``` ### Technical Analysis The fallback recursively traverses an arbitrary local repository directory and uploads every file whose extension matches a broad allowlist. That allowlist expressly includes `.env`, `.ini`, and `.cfg`, as well as JSON and YAML files that frequently contain credentials, API keys, deployment parameters, or private infrastructure metadata. The directory exclusions are narrower than those used by the normal temporary-folder publishing workflow. In particular, the fallback does not categorically exclude `.env` files, `.clawhub`, `.claude`, or other hidden local metadata. Files are read into memory and ap ...[truncated 1906 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: references/ONBOARDING.md:102

Finding

Unpinned global npm installation creates supply-chain exposure

Content

View full analysis

Remediation

View remediation

`. 2. Verify the official package name and publisher against authoritative ClawHub documentation before installation. 3. Use npm provenance and integrity information where supported, and retain a reviewed lockfile for reproducibility. 4. Prefer project-local or isolated installation over `-g`, then invoke the pinned binary through a controlled wrapper. 5. Disable lifecycle scripts during installation when the package does not require them, and document any scripts that must be enabled. 6. Avoid elevated installation. Explicitly instruct users not to run the command with `sudo` or from an administrator shell. 7. Validate the installed version and expected package provenance before authentication or publishing. 8. Define an update-review process so version changes are assessed before changing the pin. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (27)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The declared description presents a broad specification for skill development and publishing, including marketplace indexing and publishing processes. The supplied code chunk does not implement that overall specification; it performs one specific operational task: validating version consistency across project files and git tags. While version management is mentioned in the description, the code’s actual behavior is much narrower and does not cover development standards, marketplace indexing, or publishing. Therefore the description does not accurately represent this code chunk’s primary purpose.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 250)May include surrounding context.

md

- 两份 manifest 的 `name` 必须与根 `SKILL.md` 一致。

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 251)May include surrounding context.

md

- 两份 manifest 的 `name` 必须与根 `SKILL.md` 一致。

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 294)May include surrounding context.

md

- 两份 manifest 的 `name` 必须与根 `SKILL.md` 一致。

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/release-process.md (reported line 326)May include surrounding context.

text

EPERM: operation not permitted, rename 'temp_xxx' -> 'cache/.../X.Y.Z'
EBUSY: resource busy or locked, rm 'cache/.../X.Y.Z'

原因

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

This duplicate finding still reflects a true vulnerability. The skill explicitly tells the agent to execute a force-delete command against a user-scoped cache path, and the release-process context makes it more dangerous because the instructions are framed as mandatory operational steps an agent may execute without hesitation.

Content

Scanner excerpt · references/release-process.md (reported line 342)May include surrounding context.

bash

# 清理缓存
rm -rf ~/.claude/plugins/cache/<marketplace-name>/<skill-name>
rm -rf ~/.claude/plugins/cache/temp_github_*

# 重新安装

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

This duplicate finding still reflects a true vulnerability. The skill explicitly tells the agent to execute a force-delete command against a user-scoped cache path, and the release-process context makes it more dangerous because the instructions are framed as mandatory operational steps an agent may execute without hesitation.

Content

Scanner excerpt · references/release-process.md (reported line 342)May include surrounding context.

bash

# 清理缓存
rm -rf ~/.claude/plugins/cache/<marketplace-name>/<skill-name>
rm -rf ~/.claude/plugins/cache/temp_github_*

# 重新安装

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

This duplicate finding still reflects a true vulnerability. The skill explicitly tells the agent to execute a force-delete command against a user-scoped cache path, and the release-process context makes it more dangerous because the instructions are framed as mandatory operational steps an agent may execute without hesitation.

Content

Scanner excerpt · references/release-process.md (reported line 342)May include surrounding context.

bash

# 清理缓存
rm -rf ~/.claude/plugins/cache/<marketplace-name>/<skill-name>
rm -rf ~/.claude/plugins/cache/temp_github_*

# 重新安装

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 96% confidence

Finding

This finding repeats the wildcard cache cleanup command. The danger is unchanged: broad shell-based deletion in the user's home directory can remove unintended files if matching is wider than expected or if the environment differs from assumptions in the documentation.

Content

Scanner excerpt · references/release-process.md (reported line 343)May include surrounding context.

bash

# 清理缓存
rm -rf ~/.claude/plugins/cache/<marketplace-name>/<skill-name>
rm -rf ~/.claude/plugins/cache/temp_github_*

# 重新安装
claude plugin marketplace update <marketplace-name>

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 96% confidence

Finding

This finding repeats the wildcard cache cleanup command. The danger is unchanged: broad shell-based deletion in the user's home directory can remove unintended files if matching is wider than expected or if the environment differs from assumptions in the documentation.

Content

Scanner excerpt · references/release-process.md (reported line 343)May include surrounding context.

bash

# 清理缓存
rm -rf ~/.claude/plugins/cache/<marketplace-name>/<skill-name>
rm -rf ~/.claude/plugins/cache/temp_github_*

# 重新安装
claude plugin marketplace update <marketplace-name>

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

This step directs the agent to read files from ~/.claude/plugins/cache/..., which is inside an agent configuration and local state directory. Reading from agent-specific directories can expose local plugin contents, metadata, or other user-environment details that should be treated as sensitive unless explicitly necessary and user-approved.

Content

Scanner excerpt · references/release-process.md (reported line 354)May include surrounding context.

bash

# 检查缓存目录中的版本
head -5 ~/.claude/plugins/cache/<marketplace-name>/<skill-name>/<version>/SKILL.md
cat ~/.claude/plugins/cache/<marketplace-name>/<skill-name>/<version>/.claude-plugin/plugin.json | grep version
# 期望: 两处版本号均为 X.Y.Z

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

This command reads a plugin manifest from the user's Claude cache directory, again requiring direct access to agent-managed local state. Even though the intent is version verification, instructing an autonomous agent to inspect hidden configuration/cache paths normalizes access to potentially sensitive per-user data.

Content

Scanner excerpt · references/release-process.md (reported line 355)May include surrounding context.

bash

# 检查缓存目录中的版本
head -5 ~/.claude/plugins/cache/<marketplace-name>/<skill-name>/<version>/SKILL.md
cat ~/.claude/plugins/cache/<marketplace-name>/<skill-name>/<version>/.claude-plugin/plugin.json | grep version
# 期望: 两处版本号均为 X.Y.Z

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 9)May include surrounding context.

md

| 平台 | 状态 | 入口 |
| --- | --- | --- |
| Codex | ✅ | `.codex-plugin/plugin.json` + `skills/kinema-skill-making-pipeline/SKILL.md` |
| Claude Code | ✅ | `.claude-plugin/plugin.json` + 根 `SKILL.md` |
| OpenClaw / ClawHub | ✅ | 根 `SKILL.md` |

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The listed trigger conditions, especially "modifying existing skills," are broad and ambiguous because they do not define what kinds of modifications qualify or where the boundary is for activation. This can cause unintended invocation during ordinary discussion of skill maintenance or edits.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 74% confidence

Finding

The release requirements state that GitHub Release notes must include a section titled using the Chinese phrase 「更新内容」, which imposes a specific language format. Because the document does not offer a language/locale option or explain why Chinese is mandatory, this is a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

The onboarding reference explicitly includes privileged commands such as 'sudo pip3 install --break-system-packages' and 'sudo ln -sf ... /usr/local/bin/tool'. Even though labeled as a reference, this skill repeatedly instructs agents to read onboarding/setup material and adapt commands to the environment, which can lead to unnecessary root execution, system package corruption, or privileged placement of unverified files if followed blindly.

Content

Scanner excerpt · SKILL.md (reported line 220)May include surrounding context.

md

# Step 2: Install dependencies (try in order)
uv pip install --system requests 2>/dev/null || \
pip3 install requests 2>/dev/null || \
sudo pip3 install --break-system-packages requests

# Step 3: Create symlink
sudo ln -sf <skill_dir>/scripts/tool.py /usr/local/bin/tool

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 92% confidence

Finding

Creating a symlink in /usr/local/bin with sudo grants a project-controlled file system-wide execution visibility. In this skill context, where agents are guided to adapt setup references, that increases the risk of privileged persistence or accidental execution of modified repository content as a trusted command.

Content

Scanner excerpt · SKILL.md (reported line 223)May include surrounding context.

md

sudo pip3 install --break-system-packages requests

# Step 3: Create symlink
sudo ln -sf <skill_dir>/scripts/tool.py /usr/local/bin/tool

# Step 4: Verify
tool --help

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The onboarding content is presented as mandatory guidance in Chinese, and the rest of the file continues in Chinese without stating that users may choose another language. This creates a natural-language locale policy concern because it imposes a specific language without opt-in or a documented region-specific justification.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The note at L61 says the script reads the token from %APPDATA%\clawhub\config.json on Windows and ~/.config/clawhub/config.json on other systems. However, the actual code at L19 falls back to os.homedir()/AppData/Roaming/clawhub/config.json, which is still a Windows-style path and contradicts the documented non-Windows behavior.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The fallback script recursively collects many file types from a local skill directory and uploads them, authenticated with a locally stored bearer token, to an external service. In this skill context, that transmission is expected for publishing, but it is still security-relevant because the allowlist includes sensitive extensions such as .env, .ini, .cfg, and .csv, so users could unintentionally exfiltrate secrets or internal data during a publish operation.

Content

Scanner excerpt · references/clawhub-api-fallback.md (reported line 48)May include surrounding context.

md

}));
for (const f of files) form.append('files', new Blob([f.bytes], {type: 'text/plain'}), f.relPath);

fetch('https://clawhub.ai/api/v1/skills', {
  method: 'POST',
  headers: { 'Authorization': 'Bearer ' + TOKEN, 'Accept': 'application/json' },
  body: form

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This markdown instruction set uses Chinese throughout the operational guidance and user-facing reminders, while only the title is bilingual. That can amount to a language-policy violation when the skill effectively forces one language for use or maintenance without explicitly offering an alternative or opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The release process instructs the agent to delete cache directories with recursive force removal as a troubleshooting step, but it does not require an explicit user confirmation or clearly warn about side effects such as loss of local cached plugin state. In an agent-execution context, destructive commands against user home directories are risky because placeholder expansion mistakes or incorrect variable substitution could broaden the deletion scope.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · LICENSE (reported line 594)May include surrounding context.

text

THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · LICENSE (reported line 606)May include surrounding context.

text

THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The primary skill description is written in Chinese and does not indicate that users may choose another language or locale. Under the policy criteria, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.