Security audit

Clawdhub Submit

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward ClawdHub publishing helper, with some operational cautions around its optional CLI login and install commands.

Before installing, verify the ClawdHub CLI package source, consider using a pinned or isolated install instead of a global latest install, and avoid putting real tokens directly in shell commands or saved scripts. The skill itself is documentation-only and does not automatically execute commands.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:90
Finding: Unpinned Global npm Package Installation Creates Supply-Chain Risk
Content: View full analysis
Vulnerability Details

File Location: SKILL.md, lines 90-92
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Vulnerable Code Snippet:

bash
npm install -g clawdhub

Technical Analysis

The Skill instructs users to install the latest available version of the clawdhub npm package globally without pinning a reviewed version or verifying package integrity. Consequently, the installed code can change after the Skill has been audited.

npm packages may execute lifecycle scripts during installation. If the package, a transitive dependency, or its publishing account is compromised, attacker-controlled installation code could execute with the permissions of the user running the command. Global installation also modifies the user's shared tool environment instead of containing the dependency within the project.

Attack Path

An attacker compromises the clawdhub npm package, one of its dependencies, or the corresponding publisher account.

The attacker publishes a malicious package version containing a lifecycle script or altered executable.

A user follows the Skill instructions and runs npm install -g clawdhub.

npm retrieves the current compromised version because no version or integrity constraint is specified.

Malicious installation code executes under the user's account and installs or replaces the global CLI.

Subsequent use of the compromised CLI may expose publication credentials, alter uploaded content, or execute additional commands.

Impact Assessment

Successful exploitation can provide arbitrary code execution with the privileges of the user performing the installation. The attacker could access files and credentials available to that user, modify globally installed user-level tools, steal ClawdHub authentication material, or tamper with published Skills. Administrative privileges are not inherently obtained, but the impact in ...[truncated 53 chars]
Remediation: View remediation
Remediation Suggestions

Pin the CLI to a specifically reviewed version, for example clawdhub@<reviewed-version>.

Document the authoritative npm package scope, publisher, and source repository so users can detect similarly named packages.

Verify package provenance and integrity before installation, including npm signatures or registry provenance where supported.

Prefer a project-local or isolated installation over a global installation.

Where compatible with the package, disable lifecycle scripts during installation and invoke only reviewed artifacts.

Establish a controlled upgrade process that reviews new package versions and their dependency changes before updating the documented command.

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:94
Finding: Authentication Token Passed Through Command-Line Arguments
Content: View full analysis
Vulnerability Details

File Location: SKILL.md, lines 94-95
Vulnerability Type: Sensitive credential exposure through process arguments and command history
Risk Level: Medium

Vulnerable Code Snippet:

bash
clawdhub login --token YOUR_TOKEN

Technical Analysis

The documented authentication pattern encourages users to replace YOUR_TOKEN with a real credential directly in a shell command. Command-line arguments can be retained in shell history, terminal transcripts, CI/CD logs, debugging output, or process-monitoring records. Depending on the operating system and process isolation settings, another local principal may also be able to inspect the argument while the command is running.

Although the example contains only a placeholder and does not embed an actual secret, following the instruction with a real token creates an avoidable credential-disclosure condition.

Attack Path

A user replaces YOUR_TOKEN with a valid ClawdHub token and executes the documented command.

The shell records the command in its history, an automation platform captures it in logs, or a local process observer reads the command-line arguments.

Another user, malicious process, support operator, or party with access to retained logs retrieves the token.

The attacker submits the recovered token to the ClawdHub authentication interface.

The attacker performs actions allowed by the token, such as publishing or modifying Skills under the victim's account, until the token expires or is revoked.

Impact Assessment

Exploitation can disclose a valid ClawdHub authentication token and grant the attacker the same service permissions assigned to that token. The resulting scope may include unauthorized publication, modification, or management of the victim's Skills. This issue does not directly grant operating-system privilege escalation; its primary impact is account impersonation and unauthorized remote service ...[truncated 7 chars]
Remediation: View remediation
Remediation Suggestions

Replace the command-line token argument with an interactive hidden prompt that does not echo or retain the credential.

If supported by the CLI, read the token from standard input or an operating-system credential store.

For automation, use the platform's secret-management facility and ensure the value is masked in logs.

If an environment variable is unavoidable, document its exposure limitations, restrict process and file access, and unset it immediately after use.

Add an explicit warning that users must not place real tokens directly in command arguments, shell history, scripts, or source-control files.

Recommend narrowly scoped, short-lived tokens and provide clear rotation and revocation procedures for suspected exposure.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.
md
--- AIGC: ContentProducer: Minimax Agent AI ContentPropagator: Minimax Agent AI Label: AIGC ProduceID: 5eb26843fb91efc246502b0e56d5f566 PropagateID: 5eb26843fb91efc246502b0e56d5f566 ReservedCode1: 3046022100efa81f19ced3305b14d7a9cb9cc41d0296403c489eae7eb8da5b7c6ffa6809eb022100a7ad882a4d493992b10642cfe599fecdd41516cc2562916422fca86e19839dec ReservedCode2: 3045022100faadfbb863a85d110aeaea25c467102581292eb83809c41fc0856fc885b949db022024ab3430faa50e9c7e07734ddd9c3a61d2e92a6b2d0eb58130c9d2ac29eb34db --- # ClawdHub Skill 提交工具自动引导用户完成 ClawdHub skill 发布流程。 ## 触发条件当用户提到以下关键词时激活： - "提交 skill" - "发布 skill" - "上传 skill" - "clawdhub submit" - "skill 被关闭" - "PR 自动关闭" ## 功能 ### 1. 诊断问�

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The entire skill description, trigger conditions, workflow, and examples are presented only in Chinese, which effectively imposes a specific language on users. The file does not offer an opt-in choice for language or explain that the skill is intentionally limited to a Chinese-speaking or region-specific audience.
Content: No source excerpt is available for this finding.

Vague Triggers