ClawHub
Back to skill

Security audit

Skill Exporter

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent exporter purpose, but its generated service can be compromised by malicious source-skill metadata and it can delete source scripts when source and output paths overlap.

Review this skill before installing. Use it only on skills you trust, choose an output directory outside the source skill directory, inspect generated api.py before running or deploying it, avoid adding production API keys until the generated code is reviewed, and pin dependencies for production builds.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/export.py:421
Finding

Untrusted Skill Metadata Can Inject Python Code into the Generated Service

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/export.py:409
Finding

Overlapping Source and Output Paths Can Cause Recursive Data Deletion

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
scripts/export.py:138
Finding

Generated Deployments Use Unpinned Third-Party Dependencies

Content
View full analysis
=0.109.0 uvicorn[standard]>=0.27.0 python-dotenv>=1.0.0 requests>=2.31.0 pydantic>=2.5.0 {llm_deps} ''', ``` Optional LLM dependencies are likewise specified only with minimum versions: ```python if llm == "anthropic": (output_path / "llm_client.py").write_text(TEMPLATES["llm_client_anthropic.py"]) llm_deps = "anthropic>=0.18.0" deps["env_vars"].append("ANTHROPIC_API_KEY") elif llm == "openai": (output_path / "llm_client.py").write_text(TEMPLATES["llm_client_openai.py"]) llm_deps = "openai>=1.12.0" deps["env_vars"].append("OPENAI_API_KEY") ``` The generated Dockerfile installs these dependencies directly: ```dockerfile COPY requirements.txt . RUN pip install --no-cache-dir -r requirements.txt ``` ### Technical Analysis All generated Python dependencies use lower-bound constraints rather than exact, reviewed versions. Consequently, identical source exports can resolve to different dependency versions depending on the build date and package index state. This does not prove that any currently referenced package is malicious. The weakness is that future, compromised, or incompatible releases satisfying the broad constraints can automatically enter generated production images without a source-code change or explicit review. No hashes are used to verify downloaded artifacts. ### Attack Path 1. A user exports a Skill and receives a generated `requirements.txt` containing broad `>=` constraints. 2. The generated container is built at a later date. 3. Pip resolves the newest versions satisfying those constraints. 4. A dependency release may contain a security regression, compromised code, or an incompatible behavioral change. 5. The selected package is installed into the image w ...[truncated 749 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (13)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

md
- `SKILL.md` with valid frontmatter

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/export.py (reported line 191)May include surrounding context.

python
ports:
      - "{port}:{port}"
    env_file:
      - .env
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:{port}/health"]

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/export.py (reported line 256)May include surrounding context.

python
ports:
      - "{port}:{port}"
    env_file:
      - .env
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:{port}/health"]

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/export.py (reported line 509)May include surrounding context.

python
ports:
      - "{port}:{port}"
    env_file:
      - .env
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:{port}/health"]

Credential Access

High
Category
Privilege Escalation
Confidence
91% confidence
Finding

The exporter reads the source skill's real .env file and extracts variable names from it. While it does not copy values, touching a live secret-bearing file increases secret-handling risk and can normalize operating on plaintext credentials from untrusted skill directories; in adversarial contexts this also lets a crafted skill influence generated secret documentation via its local .env.

Content

Scanner excerpt · scripts/export.py (reported line 322)May include surrounding context.

python
import_matches = re.findall(r'^(?:from|import)\s+(\w+)', content, re.MULTILINE)
            python_imports.update(import_matches)
    
    # Also check .env file if exists
    env_file = skill_path / ".env"
    if env_file.exists():
        for line in env_file.read_text().splitlines():

Credential Access

High
Category
Privilege Escalation
Confidence
91% confidence
Finding

This line is part of the same behavior that loads a source skill's .env file if present. Even though only keys are added to output, scanning secret files in untrusted input expands the attack surface and may unintentionally disclose sensitive variable naming conventions or ingest attacker-controlled content into generated files.

Content

Scanner excerpt · scripts/export.py (reported line 323)May include surrounding context.

python
python_imports.update(import_matches)
    
    # Also check .env file if exists
    env_file = skill_path / ".env"
    if env_file.exists():
        for line in env_file.read_text().splitlines():
            if "=" in line and not line.startswith("#"):

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/export.py (reported line 509)May include surrounding context.

python
print(f"\n✅ Export complete: {output_path}")
    print(f"\nNext steps:")
    print(f"  1. cd {output_path}")
    print(f"  2. cp .env.example .env && edit .env")
    print(f"  3. docker-compose up --build")
    if target == "railway":
        print(f"  4. railway up")

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill describes capabilities that imply broad file, shell, environment, and possible network access, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates a least-privilege violation: an agent may grant or infer more capability than users expect, increasing the chance of unsafe file operations, command execution, or data exposure during export and deployment workflows.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: skill-exporter
description: Export Clawdbot skills as standalone, deployable microservices. Use when you want to dockerize a skill, deploy it to Railway or Fly.io, or create an independent API service. Generates Dockerfile, FastAPI wrapper, requirements.txt, deployment configs, and optional LLM client integration.
license: MIT
compatibility: Requires python3. Works with any AgentSkills-compatible agent.
metadata:

Tool Parameter Abuse

Low
Category
Tool Misuse
Confidence
15% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/export.py (reported line 407)May include surrounding context.

python
for dep in deps:
        apt_packages.append(dep)
    
    return f"RUN apt-get update && apt-get install -y --no-install-recommends \\\n    {' '.join(apt_packages)} \\\n    && rm -rf /var/lib/apt/lists/*"


def export_skill(

Tool Parameter Abuse

Low
Category
Tool Misuse
Confidence
15% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/export.py (reported line 407)May include surrounding context.

python
for dep in deps:
        apt_packages.append(dep)
    
    return f"RUN apt-get update && apt-get install -y --no-install-recommends \\\n    {' '.join(apt_packages)} \\\n    && rm -rf /var/lib/apt/lists/*"


def export_skill(

Tool Parameter Abuse

Low
Category
Tool Misuse
Confidence
15% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/export.py (reported line 407)May include surrounding context.

python
for dep in deps:
        apt_packages.append(dep)
    
    return f"RUN apt-get update && apt-get install -y --no-install-recommends \\\n    {' '.join(apt_packages)} \\\n    && rm -rf /var/lib/apt/lists/*"


def export_skill(

Chaining Abuse

Low
Category
Tool Misuse
Confidence
76% confidence
Finding

The Dockerfile RUN line concatenates detected dependency names directly into a shell command using && chaining. Because dependency names originate from scanning untrusted skill script content and are not validated against a strict allowlist at the sink, a future expansion of detection logic or malformed dep token could turn this into command injection in generated build artifacts.

Content

Scanner excerpt · scripts/export.py (reported line 407)May include surrounding context.

python
for dep in deps:
        apt_packages.append(dep)
    
    return f"RUN apt-get update && apt-get install -y --no-install-recommends \\\n    {' '.join(apt_packages)} \\\n    && rm -rf /var/lib/apt/lists/*"


def export_skill(

Static analysis

No suspicious patterns detected.