ClawHub
Back to skill

Security audit

Skill严选猎手

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly does what it advertises, but it asks agents to make network calls, install global tools, and run a remote installer while overstating its privacy and safety posture.

Install only if you are comfortable with a skill that searches external services and may guide installation of third-party CLIs. Do not allow automatic first-use setup; review each install command, avoid curl-to-bash unless independently verified, and enable weekly Cron/profile personalization only with explicit consent.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (78)

Intent-Code Divergence

High
Confidence
98% confidence
Finding
The claim that 'no data sent to any server' is contradicted by the documented use of GitHub and SkillHub HTTP APIs plus external CLIs that necessarily contact remote services. Users may disclose sensitive search terms, repository targets, or preference data under a false privacy assurance, creating a serious transparency and consent failure.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
The skill also includes recurring trending/weekly-report collection, local profile reads, and ranking logic that are not clearly reflected in the declared purpose. Hidden or under-disclosed behavior weakens informed consent and can lead to overbroad activation for actions beyond simple user-requested search.

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding
The skill also includes recurring trending/weekly-report collection, local profile reads, and ranking logic that are not clearly reflected in the declared purpose. Hidden or under-disclosed behavior weakens informed consent and can lead to overbroad activation for actions beyond simple user-requested search.

Vague Triggers

High
Confidence
95% confidence
Finding
The trigger description is overly broad and activates on vague phrases like asking for existing tools or whether something exists on GitHub. That can cause the skill to engage unexpectedly, leading to unintended network access, setup actions, or recommendation behavior without clear user intent.

Ae1

High
Category
analysis-evasion
Content
| 🔒 安全审查 | "帮我审查/安装 X Skill" | `scripts/scanner.py` |
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
| 🔒 安全审查 | "帮我审查/安装 X Skill" | `scripts/scanner.py` |
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Tool Parameter Abuse

High
Category
Tool Misuse
Content
| 🔴 HIGH | ❌ 建议拒绝 | 列出 Hard Flags，告知木老师，等待明确指令 |
| ⛔ EXTREME | ❌ 拒绝 | 直接拒绝，清理暂存区，报告木老师 |

4. 扫描完成后清理暂存区：`rm -rf /tmp/skill-hunter-staging/<skill_name>`

**安全约束**：
- 扫描器只输出摘要（rule_id / rule_name / 文件名 / 行号），不输出原始代码片段
Confidence
90% confidence
Finding
Although the cleanup target is intended to be a staging subdirectory, it interpolates `<skill_name>` into a destructive shell command. If the actual implementation does not strictly sanitize or canonicalize the name, path traversal or option-style injection could cause deletion outside the intended temp directory.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
| 🔴 HIGH | ❌ 建议拒绝 | 列出 Hard Flags，告知木老师，等待明确指令 |
| ⛔ EXTREME | ❌ 拒绝 | 直接拒绝，清理暂存区，报告木老师 |

4. 扫描完成后清理暂存区：`rm -rf /tmp/skill-hunter-staging/<skill_name>`

**安全约束**：
- 扫描器只输出摘要（rule_id / rule_name / 文件名 / 行号），不输出原始代码片段
Confidence
85% confidence
Finding
Although the cleanup target is intended to be a staging subdirectory, it interpolates `<skill_name>` into a destructive shell command. If the actual implementation does not strictly sanitize or canonicalize the name, path traversal or option-style injection could cause deletion outside the intended temp directory.

Chaining Abuse

High
Category
Tool Misuse
Content
npx clawhub --version 2>/dev/null && echo "✅ clawhub CLI" || (echo "⚠️ 正在安装 clawhub..." && npm i -g clawhub && echo "✅ clawhub 安装完成")

# 源3: SkillHub（腾讯，独立 CLI，无需鉴权）
command -v skillhub && skillhub --version 2>/dev/null && echo "✅ skillhub CLI" || (echo "⚠️ 正在安装 skillhub..." && curl -fsSL https://skillhub-1388575217.cos.ap-guangzhou.myqcloud.com/install/install.sh | bash -s -- --cli-only && echo "✅ skillhub 安装完成")

# 源4: Skills.sh（需 Node.js + npm，无需鉴权）
npx skills --version 2>/dev/null && echo "✅ skills CLI" || (echo "⚠️ 正在安装 skills..." && npm i -g skills && echo "✅ skills 安装完成")
Confidence
91% confidence
Finding
The setup command chains detection and remote installation with shell operators, culminating in `curl | bash`. Chaining obscures control flow, reduces reviewability, and increases the chance that a single pasted command performs more privileged actions than the user realizes, including arbitrary remote code execution.

Ae1

High
Category
analysis-evasion
Content
必读文件：`./SKILL.md`
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

External Script Fetching

High
Category
Supply Chain
Content
**CLI 安装**：
```bash
curl -fsSL https://skillhub-1388575217.cos.ap-guangzhou.myqcloud.com/install/install.sh | bash -s -- --cli-only
```

**搜索命令**：
Confidence
99% confidence
Finding
This command fetches a script from an external URL and executes it immediately in a shell, which is a classic unsafe installation pattern. In the context of a skill that helps users discover and install external tools, this is more dangerous because it normalizes running unreviewed third-party code and could lead to full local compromise if the source is malicious or later hijacked.

External Script Fetching

High
Category
Supply Chain
Content
**CLI 安装**：
```bash
curl -fsSL https://skillhub-1388575217.cos.ap-guangzhou.myqcloud.com/install/install.sh | bash -s -- --cli-only
```

**搜索命令**：
Confidence
99% confidence
Finding
This command fetches a script from an external URL and executes it immediately in a shell, which is a classic unsafe installation pattern. In the context of a skill that helps users discover and install external tools, this is more dangerous because it normalizes running unreviewed third-party code and could lead to full local compromise if the source is malicious or later hijacked.

External Script Fetching

High
Category
Supply Chain
Content
**CLI 安装**：
```bash
curl -fsSL https://skillhub-1388575217.cos.ap-guangzhou.myqcloud.com/install/install.sh | bash -s -- --cli-only
```

**搜索命令**：
Confidence
99% confidence
Finding
This command fetches a script from an external URL and executes it immediately in a shell, which is a classic unsafe installation pattern. In the context of a skill that helps users discover and install external tools, this is more dangerous because it normalizes running unreviewed third-party code and could lead to full local compromise if the source is malicious or later hijacked.

External Script Fetching

High
Category
Supply Chain
Content
**CLI 安装**：
```bash
curl -fsSL https://skillhub-1388575217.cos.ap-guangzhou.myqcloud.com/install/install.sh | bash -s -- --cli-only
```

**搜索命令**：
Confidence
99% confidence
Finding
This command fetches a script from an external URL and executes it immediately in a shell, which is a classic unsafe installation pattern. In the context of a skill that helps users discover and install external tools, this is more dangerous because it normalizes running unreviewed third-party code and could lead to full local compromise if the source is malicious or later hijacked.

External Script Fetching

High
Category
Supply Chain
Content
**CLI 安装**：
```bash
curl -fsSL https://skillhub-1388575217.cos.ap-guangzhou.myqcloud.com/install/install.sh | bash -s -- --cli-only
```

**搜索命令**：
Confidence
99% confidence
Finding
This command fetches a script from an external URL and executes it immediately in a shell, which is a classic unsafe installation pattern. In the context of a skill that helps users discover and install external tools, this is more dangerous because it normalizes running unreviewed third-party code and could lead to full local compromise if the source is malicious or later hijacked.

External Script Fetching

High
Category
Supply Chain
Content
**CLI 安装**：
```bash
curl -fsSL https://skillhub-1388575217.cos.ap-guangzhou.myqcloud.com/install/install.sh | bash -s -- --cli-only
```

**搜索命令**：
Confidence
99% confidence
Finding
This command fetches a script from an external URL and executes it immediately in a shell, which is a classic unsafe installation pattern. In the context of a skill that helps users discover and install external tools, this is more dangerous because it normalizes running unreviewed third-party code and could lead to full local compromise if the source is malicious or later hijacked.

Credential Access

High
Category
Privilege Escalation
Content
| R1 | 外部 URL 请求 | curl/wget 到非白名单域名 | 数据外泄 |
| R2 | base64 解码执行 | base64 -d / atob() | 隐藏 payload |
| R3 | eval/exec 动态执行 | eval() / exec() | 远程代码执行 |
| R4 | 读取系统凭证路径 | ~/.ssh / ~/.aws / /etc/shadow | 凭证窃取 |
| R5 | 访问 Agent 私密文件 | MEMORY.md / SOUL.md / agent-config.json | 隐私泄露 |
| R6 | 混淆/超长单行代码 | 单行 >500 字符 | 隐藏恶意逻辑 |
| R7 | 裸 IP 网络请求 | http://x.x.x.x | 绕过域名审查 |
Confidence
95% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
| R1 | 外部 URL 请求 | curl/wget 到非白名单域名 | 数据外泄 |
| R2 | base64 解码执行 | base64 -d / atob() | 隐藏 payload |
| R3 | eval/exec 动态执行 | eval() / exec() | 远程代码执行 |
| R4 | 读取系统凭证路径 | ~/.ssh / ~/.aws / /etc/shadow | 凭证窃取 |
| R5 | 访问 Agent 私密文件 | MEMORY.md / SOUL.md / agent-config.json | 隐私泄露 |
| R6 | 混淆/超长单行代码 | 单行 >500 字符 | 隐藏恶意逻辑 |
| R7 | 裸 IP 网络请求 | http://x.x.x.x | 绕过域名审查 |
Confidence
95% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
| R5 | 访问 Agent 私密文件 | MEMORY.md / SOUL.md / agent-config.json | 隐私泄露 |
| R6 | 混淆/超长单行代码 | 单行 >500 字符 | 隐藏恶意逻辑 |
| R7 | 裸 IP 网络请求 | http://x.x.x.x | 绕过域名审查 |
| R8 | 提权操作 | sudo / chmod 777 / chown root | 提权攻击 |
| R9 | 凭证外发 | token/key/secret + curl/fetch | 凭证泄露 |
| R10 | 未声明包安装 | pip/npm/apt install 未在文档说明 | 供应链投毒 |
| AI1 | Prompt Injection | "ignore previous instructions" 等 | 隐藏指令攻击 |
Confidence
80% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Chaining Abuse

High
Category
Tool Misuse
Content
| R5 | 访问 Agent 私密文件 | MEMORY.md / SOUL.md / agent-config.json | 隐私泄露 |
| R6 | 混淆/超长单行代码 | 单行 >500 字符 | 隐藏恶意逻辑 |
| R7 | 裸 IP 网络请求 | http://x.x.x.x | 绕过域名审查 |
| R8 | 提权操作 | sudo / chmod 777 / chown root | 提权攻击 |
| R9 | 凭证外发 | token/key/secret + curl/fetch | 凭证泄露 |
| R10 | 未声明包安装 | pip/npm/apt install 未在文档说明 | 供应链投毒 |
| AI1 | Prompt Injection | "ignore previous instructions" 等 | 隐藏指令攻击 |
Confidence
75% confidence
Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Instruction Override

High
Category
Prompt Injection
Content
| R8 | 提权操作 | sudo / chmod 777 / chown root | 提权攻击 |
| R9 | 凭证外发 | token/key/secret + curl/fetch | 凭证泄露 |
| R10 | 未声明包安装 | pip/npm/apt install 未在文档说明 | 供应链投毒 |
| AI1 | Prompt Injection | "ignore previous instructions" 等 | 隐藏指令攻击 |
| AI2 | 挖矿特征 | xmrig / stratum+tcp / coinhive | 恶意占用算力 |

## Yellow Flag 规则（Y1~Y4）
Confidence
80% confidence
Finding
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The file header describes a local static security scanner, while the skill metadata says this skill is for external skill discovery across remote sources. That mismatch means the skill can perform capability expansion beyond user-visible intent, including inspecting arbitrary local files and directories, which violates least surprise and increases privacy/security risk.

Credential Access

High
Category
Privilege Escalation
Content
{
        "id": "R4",
        "name": "读取系统凭证路径",
        "pattern": r'(~/\.ssh|~/\.aws|~/\.config/gcloud|~/\.gnupg|/etc/shadow|/etc/passwd)',
        "desc": "访问系统凭证目录（凭证窃取风险）",
        "level": "🚨 HARD REJECT",
    },
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

YARA rule 'crypto_miner_software': References to known cryptocurrency mining software [cryptominers]

High
Category
YARA Match
Content
"pattern": r'(ignore\s+(previous|all|prior)\s+instructions?|forget\s+(everything|all)|you\s+are\s+now\s+a|disregard\s+(your|all)|new\s+instructions?:)',
        "desc": "Prompt Injection 攻击（隐藏指令）",
        "level": "🚨 HARD REJECT",
        "case_insensitive": True,
    },
    {
        "id": "AI2",
        "name": "挖矿特征",
        "pattern": r'(stratum\+tcp|mining\.pool|xmrig|cryptonight|monero|coinhive)',
        "desc": "加密货币挖矿特征",
        "level": "🚨 HARD REJECT",
        "case_insensitive": True,
    },
]

YELLOW_FLAG_RULES = [
    {
        "id": "Y1",
        "name": "写入 Agent 持久化目录",
        "pattern": r'~/\.[a-z]+/',
        "desc": "写入 Agent 持久化目录（需确认写入范围是否合理）",
        "level": "⚠️ 需人工确认",
    },
    {
        "id": "Y2",
        "name": "已知外部网络请求",
        "pattern": r'(requests\.get|urllib\.request|fetch\(|axios\.get|http\.get)',
        "desc":
Confidence
80% confidence
Finding
YARA rule matched cryptocurrency mining indicators (stratum protocol, mining pools, miner binaries, or cryptojacking scripts).

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The README frames the skill primarily as a discovery tool, but the documented examples and workflows also include auditing, installing external skills, and setting up recurring delivery. This mismatch can mislead users and downstream policy engines about the real capability surface, causing them to approve a tool with broader execution and persistence behaviors than expected.

Static analysis

Detected: malicious.crypto_mining, suspicious.prompt_injection_instructions

Possible crypto mining behavior detected.

Critical
Code
malicious.crypto_mining
Location
scripts/scanner.py:104

Prompt-injection style instruction pattern detected.

Warn
Code
suspicious.prompt_injection_instructions
Location
references/security-levels.md:28