Security audit

Clawhub Cli

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent ClawHub CLI helper, but one bulk sync helper can turn a requested dry run into a real publish/sync operation.

Review carefully before installing. Use interactive clawhub login where possible, never paste real tokens into commands or support transcripts, confirm exactly what clawhub sync --all would publish, and avoid the bundled sync-all.sh --dry-run path unless you have verified that your installed CLI supports --dry-run. Manually check skill folders for secrets or proprietary content before any publish or sync.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/linux/sync-all.sh:59
Finding: Dry-Run Request Fails Open into a Real Bulk Synchronization
Content: View full analysis
&2 fi echo ">> clawhub ${args[*]}" clawhub "${args[@]}" ``` ### Technical Analysis When the user explicitly supplies `--dry-run`, the script first checks whether the installed ClawHub CLI advertises support for that option. If capability detection fails, the script only prints a warning and continues without adding `--dry-run`. The capability check can return false either because the CLI genuinely lacks the option or because the local `grep` utility is unavailable. In both cases, an operation requested as a non-mutating preview becomes the mutating command `clawhub sync --all`. This is a fail-open safety-control implementation. It also contradicts the package's documented “safe by default” design principle. Because synchronization is a bulk publishing operation, the omitted flag changes the security semantics of the command rather than merely dropping optional metadata. ### Attack Path 1. A user invokes `sync-all.sh --dry-run` to inspect what would be uploaded. 2. The installed CLI does not advertise `--dry-run`, or capability detection fails. 3. The script warns that it will run without dry-run but does not require confirmation or terminate. 4. The argument array remains `sync --all`. 5. The script executes `clawhub sync --all`. 6. Local skill content within the CLI's synchronization scope may be uploaded to ClawHub. ### Impact Assessment An authenticated user may unintentionally publish multiple local skill folders. The operation runs with the invoking user's existing filesystem access and ClawHub account permissions; it does not obtain elevated operating-system pri ...[truncated 406 chars]
Remediation: View remediation
&2 exit 1 fi fi ``` - Treat capability-detection failures separately from unsupported options. Explicitly report when required utilities or CLI help output are unavailable. - Never silently weaken a user-requested safety control. - If non-dry execution is still needed, require a separate explicit option such as `--allow-without-dry-run`. - Add a confirmation step before bulk publication when running interactively. - Perform a local preflight scan for common secrets and sensitive files before any real synchronization. - Add automated tests proving that `--dry-run` never invokes a mutating synchronization when the option is unavailable. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:46
Finding: Authentication Token Is Recommended as a Command-Line Argument
Content: View full analysis
``` ``` From `reference/CLI-COMMANDS.md:18-22`: ```markdown - Login with token: ```bash clawhub login --token ``` ``` From `reference/TROUBLESHOOTING.md:19-27`: ```markdown Actions: - run `clawhub login` (interactive), or - run `clawhub login --token ` If still failing: - verify the token is valid and not expired - verify the token has permission to publish/sync (if relevant) ``` The troubleshooting guide also requests the exact command and complete output at `reference/TROUBLESHOOTING.md:5-9`: ```markdown Capture: - the exact command that was run - the full CLI output (including the error) - the OS + shell (PowerShell, bash, etc.) ``` ### Technical Analysis The documentation repeatedly recommends substituting an API token directly into a command-line argument. Command-line secrets may be retained or exposed through: - Shell history files. - Process listings and process-inspection interfaces. - Terminal recording or screen sharing. - Agent transcripts and execution logs. - Diagnostic reports containing the exact command. - CI/CD job logs or shell tracing. The troubleshooting instructions increase this risk by asking users to capture the exact command without explicitly requiring credential redaction. Whether process listings expose command arguments depends on the operating system and timing, but shell history and transcript exposure remain common risks. ### Attack Path 1. A user follows the documented example and replaces `` with a valid ClawHub token. 2. The command is entered into a shell or agent-controlled termina ...[truncated 889 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:32
Finding: Unpinned ClawHub Package Is Installed Globally
Content: View full analysis
Remediation: View remediation
``` - Document the expected registry, package owner or publisher, and reviewed version. - Verify the package's published integrity and provenance using package-manager-supported mechanisms. - Prefer a project-local dependency with a lockfile where practical, invoking the pinned binary from the project rather than trusting a mutable global executable. - Review package lifecycle scripts and dependency changes before updating the pinned version. - Provide a controlled upgrade procedure that includes changelog review, integrity verification, and regression testing. - Avoid recommending elevated installation. Document a user-owned package installation location if global installation is operationally necessary. - Consider distribution through a verified release artifact with checksums or signatures if supported by the publisher. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The description claims the skill can search, install, update, and publish skills via the ClawHub CLI. However, this code chunk only performs one narrow operation: syncing all skills with optional metadata/versioning flags. It does not implement search, installation/fetching of new skills, or publishing. While syncing/updating is consistent with part of the description, the declared purpose materially overstates the implemented functionality of this code chunk.
Content: No source excerpt is available for this finding.

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.
md
- discover skills on ClawHub (search by keywords) - install skills into a workspace - list what is installed (as recorded by the CLI; may be lockfile-backed depending on setup) - update skills (all or a single one, latest or a pinned version) - publish one local skill folder - sync many local skill folders in bulk

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.
md
Use when the user has exactly one folder to publish and it contains a `SKILL.md`.

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · SKILL.md (reported line 150)May include surrounding context.
md
- `--dry-run` - `--bump patch|minor|major` - `--changelog "Update skills"` ## Running the `.sh` scripts on Windows

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · reference/WINDOWS-USAGE.md (reported line 69)May include surrounding context.
md
- `--dry-run` - `--bump patch|minor|major` - `--changelog "Update skills"` ## Running the `.sh` scripts on Windows

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly suggests clawhub login --token <api-token> without warning that inline tokens may be exposed via shell history, process listings, terminal logging, or shared session transcripts. This can lead to credential leakage and unauthorized access to the user's ClawHub account or publishing capabilities.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.