Skill Publish Adapter Real

• Outcome: Review
• Latest audit: Sep 11, 2026 · 11:51 PM UTC
• Version: 2.0.0

Overview

This skill should be reviewed carefully because it asks users and CI jobs to run an unverified GitHub script while the packaged metadata does not match the described tool.

Do not install or use this as-is in a real project or CI release job unless the publisher bundles the reviewed adapter script or pins it to an immutable commit with checksum or signature verification. Before publishing, review exactly what files will be packaged and ensure no secrets or credentials are included or exposed to the job.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:82
• Finding: Unpinned Remote Shell Script Download and Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 82-99 **Vulnerability Type**: `T03: Remote Payload Retrieval and Execution` **Risk Level**: Critical ### Vulnerable Code ```bash # Download the adapter curl -sSL https://raw.githubusercontent.com/puppetcat-fire/skill-publish-adapter/main/skill-publish-adapter.sh -o skill-publish-adapter.sh chmod +x skill-publish-adapter.sh # Or install through ClawHub clawhub install @clawhub/skill-publish-adapter ``` The downloaded file is subsequently invoked as follows: ```bash # 1. Validate a skill ./skill-publish-adapter.sh validate ./my-skill # 2. Automatically fix a skill ./skill-publish-adapter.sh fix ./my-skill # 3. Publish a skill ./skill-publish-adapter.sh publish ./my-skill --slug my-skill --name "My Skill" --version 1.0.0 ``` ### Technical Analysis The installation instructions retrieve a shell script from the mutable `main` branch of a personal GitHub repository. The downloaded file is granted executable permission and subsequently used for validation, modification, and publication operations. No immutable commit reference, cryptographic checksum, digital signature, or other integrity control is provided. Consequently, the effective code executed by users can change after this Skill has been reviewed. Splitting the process into `curl`, `chmod`, and a later invocation does not materially reduce the risk compared with piping the response directly into a shell. The executable payload is not included in the audited project, so its behavior cannot be verified from the package. The remote repository owner—or an attacker who compromises the repository, account, DNS path, or delivery infrastructure—can replace the script with arbitrary shell commands. This behavior exceeds the minimum privileges necessary for the declared validation and packaging functionality. Those operations could be implemented using reviewed, locally bundled code without dynamically trusting a mutable remote executable ...[truncated 1475 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Bundle the complete, reviewed adapter script inside the Skill package instead of downloading it at runtime. 2. Ensure the package actually contains every executable referenced by its installation and usage instructions. 3. If external retrieval is unavoidable: - Pin the URL to an immutable Git commit rather than `main`. - Publish and verify a SHA-256 or stronger cryptographic digest before execution. - Prefer signed release artifacts and verify the signature against a documented trusted key. - Abort installation if any integrity or signature check fails. 4. Display download and verification failures instead of using silent retrieval that can obscure diagnostics. 5. Run validation and repair operations in a restricted environment with only the target directory mounted writable. 6. Do not expose publishing credentials during validation or repair. 7. Require explicit user confirmation before modifying files or publishing artifacts. 8. Document the exact filesystem, credential, and network access required for each operation. ]]>

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:294
• Finding: Mutable Remote Payload Execution in CI/CD Publishing Workflow<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 294-301 **Vulnerability Type**: `T03: Remote Payload Retrieval and Execution` **Risk Level**: Critical ### Vulnerable Code ```yaml - name: Install adapter run: | curl -sSL https://raw.githubusercontent.com/puppetcat-fire/skill-publish-adapter/main/skill-publish-adapter.sh -o adapter.sh chmod +x adapter.sh - name: Publish skill run: | ./adapter.sh publish . \ --slug ${{ github.event.repository.name }} \ --name "${{ github.event.repository.name }}" \ --version ${GITHUB_REF#refs/tags/v} ``` ### Technical Analysis The documented GitHub Actions workflow downloads an executable shell script from the mutable `main` branch of an external personal repository and executes it during publication. The workflow does not pin the script to an immutable commit and does not verify a checksum or digital signature. CI environments are particularly sensitive because publishing jobs may possess repository write permissions, release permissions, package registry tokens, GitHub tokens, signing material, or other deployment credentials. Executing an unaudited remote payload in this context creates a direct supply-chain compromise path. The remote script is not included in the audited project, making its behavior unavailable for static review. A benign script observed at one point can be replaced after review and automatically executed by later tagged builds. This behavior exceeds least privilege. A publication workflow should execute only reviewed and integrity-verified code, with narrowly scoped workflow permissions. ### Attack Path 1. An attacker gains control over the external repository, its maintainer account, or the content served for the mutable `main` branch. 2. The attacker replaces `skill-publish-adapter.sh` with a malicious payload. 3. A tag matching the workflow trigger is pushed to a repository using the documented configuration. 4. GitHub Actions starts a runn ...[truncated 1370 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Store the reviewed publishing script in the same repository and execute that local version. 2. If retrieval is unavoidable, pin the artifact to an immutable commit and verify a documented cryptographic checksum or signature before execution. 3. Configure explicit least-privilege GitHub Actions permissions, for example granting only the narrowly required release or package permission. 4. Separate validation from publication: - Run validation without publishing credentials. - Make credentials available only to the final verified publishing step. 5. Use protected environments and required approvals for release jobs. 6. Avoid exposing long-lived credentials; use short-lived, narrowly scoped tokens where supported. 7. Prevent untrusted pull-request code or attacker-controlled artifacts from entering a privileged publishing job. 8. Generate and verify provenance for release artifacts, and review the exact script revision used by each build. 9. Fail closed if artifact retrieval, checksum verification, or signature verification does not succeed. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Ae1

High

• Category: analysis-evasion

Content

if [ ! -f "SKILL.md" ]; then

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The package metadata identifies this artifact as a 'skill-validator' that validates OpenClaw skills, while the surrounding skill context describes a 'publish-adapter' intended to bypass known ClawHub publishing problems. This identity mismatch is dangerous because it can mislead reviewers, automated tooling, and users about the skill’s actual purpose, and in this context the 'bypass' framing increases suspicion of deceptive packaging or repurposing to evade scrutiny.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill advertises automatic repair actions such as fixing script permissions, creating missing files, and correcting formats, but it does not clearly describe the exact local changes that will be made or require confirmation first. In practice, this can lead users to run file-modifying actions that alter permissions or repository state unexpectedly, which is risky in development environments.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill repeatedly instructs users to publish skills to ClawHub and GitHub, and even describes creating tarballs and GitHub repositories, but it never clearly warns that these actions can upload project contents, metadata, and possibly embedded secrets to third-party services. In a publishing adapter context, remote transmission is expected, but the lack of explicit consent and scope disclosure makes accidental data exposure more likely.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

### 常见问题
1. **"jq命令未找到"**
   ```bash
   sudo apt-get install jq  # Ubuntu/Debian
   brew install jq          # macOS
   ```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Natural-Language Policy Violations

Low

• Confidence: 94% confidence
• Finding: The manifest description is written only in Chinese ("技能检验工具：验证OpenClaw技能的结构和完整性"), which imposes a specific language choice in user-facing metadata. There is no indication elsewhere in this file that users can choose a language or that the skill is intentionally limited to a Chinese-speaking context.

Static analysis

No suspicious patterns detected.