ClawHub
Back to skill

Security audit

Skill Sync Publisher

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly transparent about publishing workflows, but it contains high-impact repository publishing behavior with a hard-coded GitHub fork owner and broad implicit invocation.

Review before installing. Use dry-run first, avoid --yes until you have checked the exact platform choices and git diff, and be especially cautious with the Awesome Codex Plugins path because it targets a hard-coded GitHub fork owner rather than clearly using your account. Do not feed untrusted CLI output from this skill back into automated decisions without sanitizing it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (6)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The skill description presents the workflow as safely validating and synchronizing a local skill across platforms, but the actual behavior includes higher-impact operations such as committing and pushing to GitHub, forking/cloning/editing external repositories, and persisting tracking state under the user's home directory. That mismatch can cause users to authorize the skill under an incomplete understanding of its side effects, increasing the risk of unintended code publication, repository modification, or local state persistence.

Vague Triggers

Medium
Confidence
92% confidence
Finding
Enabling implicit invocation without any trigger constraints allows the skill to be auto-selected in broader contexts than intended, increasing the chance it runs on ambiguous user requests. Because this skill can publish and synchronize content across multiple external registries, unintended invocation could cause unauthorized disclosure, unwanted publication, or accidental updates to third-party platforms.

Unvalidated Output Injection

High
Category
Output Handling
Content
def run(args: list[str], cwd: Path, dry_run: bool = False) -> Result:
    if dry_run:
        return Result("planned", "would run: " + " ".join(args))
    result = subprocess.run(args, cwd=cwd, text=True, capture_output=True, check=False)
    if result.returncode:
        detail = (result.stderr or result.stdout).strip()[-1000:]
        return Result("failed", f"{args[0]} failed: {detail}")
Confidence
80% confidence
Finding
subprocess.run(args, cwd=cwd, text=True, capture_output

Unvalidated Output Injection

High
Category
Output Handling
Content
fork = f"{owner}/awesome-codex-plugins"
    view = subprocess.run([gh, "repo", "view", fork], cwd=root, text=True, capture_output=True, check=False)
    if view.returncode:
        created = subprocess.run([gh, "repo", "fork", repo, "--clone=false"], cwd=root, text=True, capture_output=True, check=False)
        if created.returncode:
            return Result("failed", f"could not create Awesome list fork: {(created.stderr or created.stdout).strip()[-1000:]}")
    with tempfile.TemporaryDirectory(prefix="awesome-codex-plugins-") as temp:
Confidence
79% confidence
Finding
subprocess.run([gh, "repo", "fork", repo, "--clone=false"], cwd=root, text=True, capture_output

Unvalidated Output Injection

High
Category
Output Handling
Content
["git", "commit", "-m", f"feat: add {info['name']}"],
            ["git", "push", "-u", "origin", branch],
        ):
            result = subprocess.run(command_args, cwd=checkout, text=True, capture_output=True, check=False)
            if result.returncode:
                return Result("failed", f"Awesome list command failed: {(result.stderr or result.stdout).strip()[-1000:]}")
        body = f"Adds [{info['name']}]({source_url}) to the Development & Workflow section.\n\nThe source repository includes the required plugin manifest, security files, and HOL scanner workflow."
Confidence
78% confidence
Finding
subprocess.run(command_args, cwd=checkout, text=True, capture_output

Unvalidated Output Injection

High
Category
Output Handling
Content
if result.returncode:
                return Result("failed", f"Awesome list command failed: {(result.stderr or result.stdout).strip()[-1000:]}")
        body = f"Adds [{info['name']}]({source_url}) to the Development & Workflow section.\n\nThe source repository includes the required plugin manifest, security files, and HOL scanner workflow."
        pr = subprocess.run([gh, "pr", "create", "--repo", repo, "--head", f"{owner}:{branch}", "--base", "main", "--title", f"feat: add {info['name']}", "--body", body], cwd=checkout, text=True, capture_output=True, check=False)
        if pr.returncode:
            return Result("failed", f"could not open Awesome list PR: {(pr.stderr or pr.stdout).strip()[-1000:]}")
        return Result("published", "Awesome Codex Plugins PR opened", {"remoteUrl": pr.stdout.strip().splitlines()[-1]})
Confidence
80% confidence
Finding
subprocess.run([gh, "pr", "create", "--repo", repo, "--head", f"{owner}:{branch}", "--base", "main", "--title", f"feat: add {info['name']}", "--body", body], cwd=checkout, text=True, capture_output

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.