ClawHub
Back to skill

Security audit

auto-publisher-self-learning

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly matches its publishing purpose, but it also directs the agent to modify installed ClawHub CLI code and keep persistent local publish history without strong user controls.

Review this carefully before installing. It can publish skills, write local learning files, install the ClawHub CLI globally, and patch installed ClawHub CLI JavaScript files. Only use it in an environment where you are comfortable with those changes, and require manual confirmation before package installation, CLI patching, batch publishing, or version bumps.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The skill instructs the agent to search broad filesystem locations, including root-level paths, to find and modify installed third-party CLI code with sed. This exceeds the scope of publishing a local skill and creates a dangerous capability for arbitrary system modification, supply-chain tampering, and persistence in future CLI executions.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The manifest markets the skill as an automated publisher with self-learning retries, but the implementation includes undocumented global modification of external tooling. This mismatch is security-relevant because users may grant execution expecting bounded publish behavior, while the skill actually performs privileged local code alteration.

Vague Triggers

Medium
Confidence
76% confidence
Finding
The trigger phrases are broad enough that normal conversation about publishing or deploying a skill could invoke the workflow unintentionally. Because the workflow includes Bash execution, writes, web access, and persistent state updates, accidental activation increases the chance of unintended side effects.

Missing User Warnings

High
Confidence
95% confidence
Finding
The skill description does not warn users that it may modify local CLI files under system or user installation paths. Omitting this warning prevents informed consent for a high-risk action that can alter trusted developer tooling and affect future commands beyond the current task.

Missing User Warnings

Medium
Confidence
83% confidence
Finding
The skill persistently stores publish history, failure patterns, and environment state under the user's home directory without a clear user warning or retention policy. Persistent local telemetry can expose operational details, project metadata, and behavior patterns, especially if the data grows over time or is later accessed by other tools.

Session Persistence

Medium
Category
Rogue Agent
Content
visibility: "public"
allowed-tools:
  - Read
  - Write
  - Edit
  - Bash
  - Grep
Confidence
80% confidence
Finding
The skill is explicitly designed to maintain persistent session memory and operational history across runs, combined with write/edit/bash/web capabilities. This creates a real persistence risk because state can influence later behavior, accumulate sensitive metadata, and make actions less transparent or auditable to the user over time.

Static analysis

No suspicious patterns detected.