Clawsmith

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 11:23 PM UTC
• Version: 1.1.0

Overview

ClawSmith is a coherent OpenClaw skill-building assistant with some scope and supply-chain cautions but no artifact-backed malicious behavior.

Review generated skills before saving or publishing them, especially metadata, required binaries, environment variables, and any generated helper scripts. Install the ClawHub CLI only from a trusted registry or pinned version when possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5

Finding

Unpinned Automatically Installed Node.js Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 5
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

yaml

metadata: {"openclaw":{"emoji":"hammer","requires":{"bins":["clawhub","git"]},"install":[{"kind":"node","package":"clawhub","bins":["clawhub"],"label":"Install ClawHub CLI"}]}}

Technical Analysis

The installation metadata requests the clawhub Node.js package without specifying an exact version or integrity constraint. Consequently, the package resolved during installation may change over time and differ from the release originally reviewed.

Node.js package installation may execute lifecycle scripts belonging to the package or its transitive dependencies. The project provides no lockfile, cryptographic checksum, provenance requirement, registry restriction, or vendored artifact with which to authenticate the code that will be installed. This creates a supply-chain exposure if a future package version, package maintainer account, distribution registry, or transitive dependency is compromised.

The audit did not establish that the current clawhub package is malicious. The finding concerns the unsafe and non-reproducible dependency declaration.

Attack Path

1. An attacker compromises the published clawhub package, its maintainer account, or a transitive dependency and releases a malicious version.
2. A user installs the skill after that release.
3. Because no exact version or integrity value is declared, the package manager resolves the attacker-controlled version.
4. Malicious package code or an installation lifecycle script executes during installation.
5. The payload operates with the privileges of the user or process performing the installation.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the installer’s privileges. Depending on that account’s access, the payload could read or modify user files, access environment variables ...[truncated 279 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin clawhub to a reviewed, exact version rather than relying on an implicitly current release.
2. Record and verify the package’s registry integrity hash or equivalent cryptographic digest.
3. Use a lockfile or other supported mechanism to pin all transitive dependencies.
4. Restrict dependency resolution to an explicitly trusted package registry.
5. Require package provenance or signature verification where supported.
6. Review installation lifecycle scripts and install dependencies with scripts disabled when they are unnecessary.
7. Perform installation under a minimally privileged, sandboxed account with restricted filesystem, credential, and network access.
8. Establish an update process in which new dependency versions are audited before the pin and integrity metadata are changed.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

md

**Mode 8: One-Click Full Pipeline**
Give it one sentence describing your skill idea. ClawSmith generates the complete folder structure, writes the SKILL.md with proper frontmatter, validates all metadata declarations, checks security requirements, generates a README, and provides the exact publish command. Idea to publish-ready in one interaction.

**Mode 9: Self-Evolve Mode**
Reviews your published skill and suggests improvements based on ClawHub best practices. Recommends better description keywords, missing features that users might expect, security updates for new ClawHub requirements, and version bump guidance. Helps keep your skill ranking high.

**Mode 10: Bulk Creator**

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 77% confidence

Finding

The invocation guidance encourages the skill to persist as the handler across a broad range of future requests about creating, optimizing, or publishing skills. That kind of sticky routing can bias future turns toward this skill without renewed user consent, especially in long sessions with mixed intents.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md

Use ClawSmith whenever you or the user says anything like:

- "Create a new skill" or "Build me a skill for X"
- "Help me write a SKILL.md"
- "I want to publish a skill on ClawHub"
- "Scaffold a new OpenClaw skill project"

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill advertises activation on very broad, everyday phrases like creating or publishing a skill, which increases the chance of unintended invocation in unrelated conversations. Because this skill can generate, audit, and prepare artifacts for publication, accidental triggering could steer the agent into performing actions the user did not explicitly request.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The additional trigger examples remain overly generic and lack boundaries, so normal requests about writing, improving, or checking a file could invoke the skill even when the user did not intend to use it. Overbroad routing is risky because it expands the skill's authority beyond a clearly consented scope.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The statement that ClawSmith should handle any request to create, optimize, validate, or publish skills defines an overly broad activation condition. This can cause the skill to intercept a wide class of tasks, including sensitive publishing workflows, without sufficiently explicit user intent or narrower domain checks.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.