Skill Auto Publisher

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:49 AM UTC
• Version: 1.1.0

Overview

This appears to be a real ClawHub publishing helper, but it can publish and modify metadata without the documented confirmation step and contains a validated local code-execution bug in its publish script.

Install only after review if you are comfortable with a publishing helper that can modify skill metadata and publish through local ClawHub credentials. Use it only on trusted skill directories, add a real confirmation or dry-run gate before publishing, and fix the python3 -c interpolation bug before processing third-party or untrusted skills.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/publish.sh:77

Finding

Arbitrary Python Code Execution Through Unsafe Source Interpolation

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description presents a comprehensive publishing assistant covering the entire release pipeline. The actual code chunk only implements skill-name/slug availability detection via a CLI search and alternative-name suggestions. While slug validation could be a small supporting part of a publishing workflow, this code does not show any of the core declared behaviors such as automatic version bumping, changelog generation, metadata validation broadly, confirmation, or one-click publishing. Therefore the supplied code chunk does not accurately represent the declared primary purpose and is a material mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The code broadly matches the core purpose of publishing a skill to ClawHub with automatic version increment and metadata validation. However, the description claims a fuller workflow than the code actually implements. Specifically, there is no logic for generating a changelog automatically or intelligently; the script merely accepts --changelog as an optional input. There is also no user confirmation step before publication—the script proceeds directly to publishing after validation and version update. Additionally, the code performs slug availability checking and publish-history recording, which are extra behaviors not reflected in the description. The most material issue is that two prominently advertised capabilities—intelligent changelog generation and user confirmation—are absent, so the description does not accurately represent the code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description promises an end-to-end ClawHub publishing assistant with automated versioning, changelog generation, metadata validation, confirmation, and one-click publish behavior. The supplied code only implements local history storage and retrieval via .publish_history.json. It computes file hashes, records version/changelog/timestamp/snapshot metadata, and prints history. While publish-history tracking could be a supporting component of a publishing tool, this code chunk by itself does not implement the main declared workflow and lacks the central publishing capabilities. Therefore the description materially overstates what this code actually does.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 143)May include surrounding context.

md

"SKILL.md": "hash:abc123",

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill documentation clearly instructs the agent to read and write files and invoke shell commands, but the manifest declares no explicit tool scope or permissions. In a publishing workflow that touches local history files and can invoke a publish script with shell arguments, missing scope boundaries increases the chance of unintended command execution or file modification beyond the intended skill directory.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest advertises broad trigger words without clear exclusions, making accidental or contextually inappropriate activation more likely. Because this skill's purpose includes potentially sensitive actions like file modification and publishing, overbroad activation materially increases the chance of unintended execution.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Broad triggers like '发布这个技能' or publishing the 'current skill' can cause the agent to act on an inferred target rather than an explicitly identified one. In a skill that may write files, update versions, and run publish commands, ambiguous activation increases the risk of publishing the wrong project or performing side effects in the wrong directory.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This code uses Chinese-only natural-language strings in its docstrings and all user-facing console messages, such as the usage text and status/error output. That creates a locale/language policy concern because the skill imposes a specific language on users without any opt-in, fallback, or documented region-specific justification.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/check_slug.py (reported line 11)May include surrounding context.

python

def check_slug_available(slug):
    """检查技能名称是否可用"""
    try:
        result = subprocess.run(
            ["skillhub", "search", slug],
            capture_output=True,
            text=True,

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This shell script's comments, usage text, and runtime status/error messages are all presented in Chinese, including the user-facing outputs at invocation and failure points. The file does not offer any language selection, fallback, or documentation justifying a Chinese-only locale, which conflicts with the policy against forcing a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script performs the irreversible publish action immediately after validation and version updates, with no interactive confirmation or dry-run safeguard. In a publishing skill, this increases the risk of accidental releases, especially because the skill metadata explicitly suggests there should be a user confirmation step, so operators may rely on a protection that does not actually exist.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This code presents its docstrings, usage help, errors, and status messages only in Chinese, including the top-level description and all CLI output. The policy requires flagging language or locale constraints when the skill forces a specific language without user opt-in or documented justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This code file contains user-facing natural-language strings in Chinese, beginning with the module docstring, and all subsequent CLI output is also Chinese-only. The policy requires avoiding forced language or locale constraints unless the skill offers a choice or clearly documents a justified region-specific limitation, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The usage text, validation status, error labels, warning labels, and failure message are all emitted only in Chinese. Because the script does not offer user opt-in for language selection or document a justified locale restriction, it forces a specific language on users.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.