ClawHub
Back to skill

Security audit

Skillhub

Security checks for vulnerabilities and agentic risk

Overview

The skill is a plausible SkillHub helper, but its batch workflow can publicly publish local skill folders to GitHub and its install instructions include an overbroad forced delete command.

Install only if you want an agent to automate SkillHub publishing and, when using batch_release.py, potentially create public GitHub repositories from local skill folders. Use dry-run first, pass --stage publish when you do not want GitHub sync, inspect and trust ~/.workbuddy/tools/push_via_api.py before using it, and manually verify or back up the skills directory before running the documented Move-Item/Remove-Item flattening commands.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (35)

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding
The manifest claims a constrained SkillHub search/install/publish/status purpose, but the documented behavior extends into local Git repository management, public GitHub repository creation, committing, pushing, and batch-release orchestration. This mismatch can mislead users and calling systems about the real side effects, causing them to authorize a skill that performs broader external publication and local state changes than expected.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
The manifest claims a constrained SkillHub search/install/publish/status purpose, but the documented behavior extends into local Git repository management, public GitHub repository creation, committing, pushing, and batch-release orchestration. This mismatch can mislead users and calling systems about the real side effects, causing them to authorize a skill that performs broader external publication and local state changes than expected.

Credential Access

High
Category
Privilege Escalation
Content
`~/.local/bin/skillhub.cmd`（cmd/PS）、`skillhub`（Git Bash）
- **Python**：默认系统 `python.exe`（managed 3.13 跑网络请求会 segfault）；
  覆盖用环境变量 `SKILLHUB_PYTHON`。
- **登录**（仅发布需要）：`skillhub login --key skh_xxx`，token 落 `~/.skillhub/credentials.json`。
  不确定就跑 `doctor` 自检四项。
- 搜索 / 安装 / 查状态**无需登录**；发布要联网并过平台三线审核。
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
`~/.local/bin/skillhub.cmd`（cmd/PS）、`skillhub`（Git Bash）
- **Python**：默认系统 `python.exe`（managed 3.13 跑网络请求会 segfault）；
  覆盖用环境变量 `SKILLHUB_PYTHON`。
- **登录**（仅发布需要）：`skillhub login --key skh_xxx`，token 落 `~/.skillhub/credentials.json`。
  不确定就跑 `doctor` 自检四项。
- 搜索 / 安装 / 查状态**无需登录**；发布要联网并过平台三线审核。
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
`~/.local/bin/skillhub.cmd`（cmd/PS）、`skillhub`（Git Bash）
- **Python**：默认系统 `python.exe`（managed 3.13 跑网络请求会 segfault）；
  覆盖用环境变量 `SKILLHUB_PYTHON`。
- **登录**（仅发布需要）：`skillhub login --key skh_xxx`，token 落 `~/.skillhub/credentials.json`。
  不确定就跑 `doctor` 自检四项。
- 搜索 / 安装 / 查状态**无需登录**；发布要联网并过平台三线审核。
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Ae1

High
Category
analysis-evasion
Content
- **技能自我覆盖**：脚本从远端下整包、原地覆盖自己的 `SKILL.md` 与脚本，且摘要校验形同虚设
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Env Variable Harvesting

High
Category
Data Exfiltration
Content
def cli_env():
    """skillhub CLI 在 Git Bash 下会 RuntimeError: Could not determine home directory，
    显式给 HOME / USERPROFILE 即可。"""
    env = dict(os.environ)
    env["HOME"] = str(HOME)
    env["USERPROFILE"] = str(HOME)
    env["PYTHONIOENCODING"] = "utf-8"
Confidence
60% confidence
Finding
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
def cli_env():
    """skillhub CLI 在 Git Bash 下会 RuntimeError: Could not determine home directory，
    显式给 HOME / USERPROFILE 即可。"""
    env = dict(os.environ)
    env["HOME"] = str(HOME)
    env["USERPROFILE"] = str(HOME)
    env["PYTHONIOENCODING"] = "utf-8"
Confidence
60% confidence
Finding
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill documents and relies on powerful capabilities including shell execution, filesystem access, environment inspection, network access, and file modification, yet it declares no explicit tool scope or permissions boundary in the manifest. This increases the chance of over-privileged execution, accidental misuse, or silent expansion of what the agent may do on a user's machine.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The natural-language invocation examples include ambiguous everyday phrases like re-release or publish that are not tightly scoped to SkillHub. In an automated routing context, that ambiguity can dispatch this skill for unrelated release tasks, exposing the user to shell, file, and network side effects outside the intended context.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The trigger list includes broad phrases related to release, publishing, and store actions that may match common user intents beyond this specific skill. Over-broad activation can cause an agent to invoke a high-privilege skill unexpectedly, leading to unintended installation, file modification, publication, or network operations.

Description-Behavior Mismatch

Medium
Confidence
96% confidence
Finding
The skill's declared business purpose centers on SkillHub store operations, but the documentation introduces GitHub repository creation/synchronization and batch orchestration as additional behaviors. Hidden or under-disclosed secondary functions are risky because they can exfiltrate code to third-party services or alter repository state under a narrower trust model than users intended.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
GitHub API interaction is a materially different capability from SkillHub search/install/status and expands data flow to another external platform. If not clearly justified and scoped, it can publish local code, metadata, or repository history to GitHub when the user only expected SkillHub store operations.

Natural-Language Policy Violations

Medium
Confidence
91% confidence
Finding
The title and entire document content are written in Chinese, with no indication that language selection is optional or that the file is intended only for a China-specific audience. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.

Natural-Language Policy Violations

Medium
Confidence
84% confidence
Finding
The statement `SkillHub 是国内优先的技能源，比公共 registry 更快、更合规` expresses a locale-specific preference as normative guidance, steering users toward a domestic source by default. The file does not present this as an optional choice or justify it as a region-specific compliance requirement for a defined audience.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The document includes PowerShell commands that forcibly move and recursively delete directories (`Move-Item ... -Force`, `Remove-Item ... -Recurse -Force`) in a user skill directory, but it does not give an explicit warning about possible data loss or the need to verify paths before execution. In a skill-installation context, users may copy-paste these commands directly; if variables are wrong or the directory structure differs, this can delete unintended content or disrupt installed skills.

Natural-Language Policy Violations

Medium
Confidence
97% confidence
Finding
The module docstring presents all user-facing usage instructions, options, and exit-code descriptions only in Chinese. For a generally applicable release automation script, this is a language-policy concern because it imposes a specific language on users without any documented opt-in or alternative locale.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
def run(cmd, cwd=None, env=None):
    r = subprocess.run(cmd, cwd=cwd, env=env, capture_output=True, text=True,
                       encoding="utf-8", errors="replace")
    return r.returncode, ((r.stdout or "") + (r.stderr or "")).strip()
Confidence
70% confidence
Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.

External Transmission

Medium
Category
Data Exfiltration
Content
sys.dont_write_bytecode = True

API = "https://api.skillhub.cn/api/v1"
HOME = Path(os.path.expanduser("~"))

# ── 平台 13 个分类枚举（实测） ──────────────────────────────────────────────
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
sys.dont_write_bytecode = True

API = "https://api.skillhub.cn/api/v1"
HOME = Path(os.path.expanduser("~"))

# ── 平台 13 个分类枚举（实测） ──────────────────────────────────────────────
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
sys.dont_write_bytecode = True

API = "https://api.skillhub.cn/api/v1"
HOME = Path(os.path.expanduser("~"))

# ── 平台 13 个分类枚举（实测） ──────────────────────────────────────────────
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
sys.dont_write_bytecode = True

API = "https://api.skillhub.cn/api/v1"
HOME = Path(os.path.expanduser("~"))

# ── 平台 13 个分类枚举（实测） ──────────────────────────────────────────────
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
sys.dont_write_bytecode = True

API = "https://api.skillhub.cn/api/v1"
HOME = Path(os.path.expanduser("~"))

# ── 平台 13 个分类枚举（实测） ──────────────────────────────────────────────
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
sys.dont_write_bytecode = True

API = "https://api.skillhub.cn/api/v1"
HOME = Path(os.path.expanduser("~"))

# ── 平台 13 个分类枚举（实测） ──────────────────────────────────────────────
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
sys.dont_write_bytecode = True

API = "https://api.skillhub.cn/api/v1"
HOME = Path(os.path.expanduser("~"))

# ── 平台 13 个分类枚举（实测） ──────────────────────────────────────────────
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.