Security audit

TrustSkills

Security checks for vulnerabilities and agentic risk

Overview

This skill is a non-executable trust-source checklist that is coherent with its stated purpose, though users should treat its allowlist decisions as provenance guidance rather than proof a skill is safe.

Use this skill as a quick provenance check only. A Trusted result means the source matches this skill's allowlist, not that the specific skill version is safe, unchanged, signed, or malware-free; review the artifact itself before installing anything with meaningful access.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:121
Finding: Static Publisher Allowlisting Can Produce Unverified Trust Decisions
Content: View full analysis
` - Skill pattern: `https://clawhub.ai//` - Trust rule: this is a narrow trusted publisher exception, not a blanket trust rule for ClawHub. - Extra rule: if you already trust OpenClaw as created by `steipete`, then trusting skills published by `steipete` on ClawHub does not downgrade that trust. - Important caveat: do not extend this rule to all ClawHub publishers or all popular ClawHub listings. - Decision rule: trust `https://clawhub.ai/steipete/` because it maps to the trusted `steipete` publisher profile above. For other ClawHub skill URLs, do not trust them under this compact version unless they match another explicit allowlist rule. ``` ### Technical Analysis The skill directs the agent to return a definitive trust decision based on a URL path and a static assumption about publisher identity. The policy does not require verification of current account ownership, repository or artifact integrity, immutable revisions, digital signatures, redirect destinations, or whether the content has changed since the source was allowlisted. Consequently, the URL namespace acts as a trust credential even though control of the corresponding publisher account or hosted content could change. A syntactically matching URL therefore may receive a `Trusted` decision without establishing that the specific artifact is safe or authentic. The document does acknowledge elsewhere that the skill does not perform malware analysis or signature verification. However, those caveats do not fully address the risk created by an unconditional trust label in a security-sensitive installation workflow. ### Attack Path 1. An attacker ...[truncated 1496 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill includes broad natural-language trigger examples such as questions about whether a source is official or trustworthy, which can overlap with normal conversation and cause unintended invocation. In a trust-decision skill, accidental routing is risky because users may receive an authoritative-looking trust verdict without explicitly intending to invoke this policy, potentially shaping install decisions based on a narrow allowlist.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.