ClawHub
Back to skill

Security audit

来了

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its skill-management purpose, but it recommends high-impact install and forced bulk-update commands that can replace local skills without enough safety guidance.

Review this skill before installing. Use it only in a trusted workspace, prefer pinned versions, confirm the registry and target skill directory, avoid `--all --no-input --force` unless you have backups or version control, and understand where `clawhub login` stores publishing credentials.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:8
Finding

Unpinned Global CLI Installation and Unattended Remote Skill Updates

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 8–16, 25–29, and 44–58
Vulnerability Type: Unpinned third-party dependency and forced remote updates
Risk Level: Medium

Vulnerable Code

yaml
"install":
  [
    {
      "id": "node",
      "kind": "node",
      "package": "clawhub",
      "bins": ["clawhub"],
      "label": "Install ClawHub CLI (npm)",
    },
  ],
bash
npm i -g clawhub
bash
clawhub update my-skill
clawhub update my-skill --version 1.2.3
clawhub update --all
clawhub update my-skill --force
clawhub update --all --no-input --force

Technical Analysis

The npm package declaration and installation command do not pin clawhub to an exact reviewed version or verify a package integrity hash. The command installs the package globally, so npm resolves and installs whichever release is current when the command is executed. npm package installation can also execute package lifecycle scripts with the privileges of the invoking user.

The documented clawhub update --all --no-input --force command retrieves mutable remote Skill releases, suppresses interactive confirmation, and forces replacement of local content. This weakens opportunities to review changed instructions or code before installation and can overwrite locally reviewed modifications.

The behavior is consistent with the Skill's declared package-management purpose; there is no evidence that the reviewed file itself contains an intentionally malicious payload. The risk arises from extending trust to mutable third-party packages and remotely hosted Skill content without version pinning, integrity validation, or mandatory review.

Attack Path

  1. An attacker compromises the publisher account, npm package, registry infrastructure, or a remotely hosted Skill release.
  2. The attacker publishes a modified clawhub package or Skill version containing malicious code or instructions.

...[truncated 1248 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the CLI to a reviewed exact version in both metadata and documentation, for example:

    yaml
    "package": "clawhub@X.Y.Z"
    bash
    npm install -g clawhub@X.Y.Z

  2. Prefer project-local installation over global installation and execute it through a constrained package script or npx with an exact version.

  3. Use a lockfile and verify npm integrity metadata or independently published checksums before installation.

  4. Verify the package publisher, package provenance, and registry source. Restrict package retrieval to an approved registry.

  5. Do not recommend --no-input --force as the normal update workflow. Require explicit confirmation and review of version, publisher, changelog, and file differences.

  6. Pin remote Skills to reviewed versions rather than automatically upgrading all Skills to the latest available release.

  7. Back up or version-control local Skill directories before updates so forced replacement cannot silently destroy reviewed changes.

  8. Run installation and update operations under a least-privileged account in an isolated environment, without access to unrelated credentials or sensitive files.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill instructs users to run authentication and publish-related commands without warning that credentials may be stored locally, transmitted over the network, or expose account-scoped publishing capability. In a skill that interfaces with a remote package registry, omission of these warnings can lead users to authenticate or publish from sensitive environments without understanding the security implications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The install, update, and publish examples do not clearly warn that they modify local skill directories and may overwrite, add, or replace files in the workspace. In this context, the skill's whole purpose is to fetch and apply remote skill content, so failing to foreground filesystem modification risk makes accidental damage or unreviewed supply-chain changes more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The documented use of bulk update, force, and non-interactive flags can trigger sweeping changes to installed skills without user review or rollback planning. Because this skill manages executable agent skills fetched from a remote registry, unattended forced updates increase the chance of introducing breaking, unsafe, or unexpected behavior across the local environment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.