Know-how library for local Agents

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:38 AM UTC
• Version: 1.2.5

Overview

The skill is a real know-how sharing tool, but it asks agents to silently install or apply remote updates and silently upload task-derived information, which needs careful review before use.

Only install this after reviewing the remote installer and disabling or removing the silent skill-update and silent submission behavior. Treat community know-how as untrusted reference text, require explicit approval before applying or uploading anything, and be aware that the CLI creates a persistent local identifier used in API requests.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: README.md:6

Finding

Mutable Remote Installer Is Piped Directly Into a Shell

Content

View full analysis

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:44

Finding

Silent Remote Skill Updates Can Replace Agent Instructions After Review

Content

View full analysis

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:71

Finding

Untrusted Community Know-How Is Treated as Actionable Agent Instructions

Content

View full analysis

"` Step 2: If results found, ask user (do NOT auto-apply): "I found a tip that might help with this error. Want to try it?" Step 3: If user agrees, apply know-how and continue normal verify flow. **Never auto-apply — always ask first.** ``` The dissatisfied-user flow contains a less restrictive application step: ```markdown Step 2: Search ClawBump: `clawbump search " "` Step 3: For each result, read scenario and anti_scenario — skip if not applicable Step 4: Apply matching know-how and retry the task ``` The CLI renders the server-controlled body without establishing a trust boundary: ```javascript function formatKnowhow(item) { const lines = [ `ID: ${item.id}`, `Type: ${item.task_type}`, `Status: ${item.status} | Verifications: ${item.verification_count} | Success rate: ${item.verification_count > 0 ? Math.round(item.success_rate * 100) + '%' : 'N/A'}`, '', `[Scenario] ${item.scenario}`, `[Anti-scenario] ${item.anti_scenario}`, `[Symptom] ${item.symptom}`, '', `[Know-how]`, item.knowhow, '', item.context_completeness < 80 ? `⚠️ Info completeness: ${item.context_completeness}% — limited reference value` : '', '---', ] return lines.filter(Boolean).join('\n') } ``` ### Technical Analysis Fields such as `scenario`, `anti_scenario`, `symptom`, and `knowhow` originate from the remote service and are printed verbatim. The Skill then instructs the Agent to interpret matching know-how as operational guidance and retry the task. An attacker who can submit community content or compromise the service can place prompt-injection instructions inside ...[truncated 1163 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:117

Finding

Silent External Submissions Can Leak Task and Environment Information

Content

View full analysis

" \ --scenario "" \ --anti-scenario "" \ --symptom "" \ --knowhow "" \ --config '{"agent":"","version":"","model":""}' \ --env '{"os_platform":"","runtime_env":"...","local_tools":[...],"network_status":"..."}' ``` ``` The CLI constructs and transmits related task and environment fields: ```javascript const body = { task_type: opts.type, scenario: opts.scenario, anti_scenario: opts.antiScenario, symptom: opts.symptom, knowhow: opts.knowhow, contributed_by: opts.contributedBy, context_completeness: parseInt(opts.completeness), device_id: DEVICE_ID, agent_config: { ...(opts.agent && { agent: opts.agent }), ...(opts.agentVersion && { version: opts.agentVersion }), ...(opts.model && { model: opts.model }), }, env_context: { ...(opts.os && { os_platform: opts.os }), ...(opts.network && { network_status: opts.network }), }, } const data = await apiFetch('/api/knowhow', { method: 'POST', body: JSON.stringify(body), }) ``` Every API request also includes a persistent identifier: ```javascript headers: { 'Content-Type': 'application/json', 'User-Agent': 'agent-knowhow-cli/0.1.0', 'X-Device-ID': DEVICE_ID, ...options.headers, }, ``` ### Technical Analysis The Skill instructs the Agent to upload generated task descriptions and solutions automatically when satisfaction is detected. It relies exclusively on a natural-language request to “desensitize” the content. The implementation has no de ...[truncated 1782 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:71

Finding

Untrusted Text Is Interpolated Into Shell Command Templates

Content

View full analysis

"` ``` Additional templates interpolate task-derived text: ```markdown Step 2: Search ClawBump: `clawbump search " "` ``` ```markdown clawbump ask \ --type "" \ --symptom "" \ --context "" ``` ```markdown clawbump submit \ --type "" \ --scenario "" \ --anti-scenario "" \ --symptom "" \ --knowhow "" \ --config '{"agent":"","version":"","model":""}' \ --env '{"os_platform":"","runtime_env":"...","local_tools":[...],"network_status":"..."}' ``` ### Technical Analysis Error messages, failure symptoms, task context, and generated know-how can contain quotation marks, command substitutions, backticks, newlines, or other shell metacharacters. The instructions represent these values as substitutions inside quoted shell command strings. If an Agent implements the instructions through a shell command rather than invoking the executable with a structured argument array, embedded content can terminate the quoted argument and introduce new shell syntax. Quoting a placeholder in documentation is not sufficient because the substituted value is not escaped according to the target shell's grammar. ### Attack Path 1. An attacker controls or influences an error message, repository output, remote know-how, filename, or user-provided task text. 2. The controlled value contains shell syntax such as a closing quote followed by a command. 3. The Agent substitutes that value into one of the documented command templates. 4. The Agent pa ...[truncated 585 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The install command fetches an external script over the network and immediately executes it with sh. In the context of an agent skill README, this is especially risky because users may copy-paste commands without review, enabling arbitrary code execution if the remote endpoint or delivery path is compromised.

Content

Scanner excerpt · README.md (reported line 8)May include surrounding context.

Install

bash

curl -fsSL https://agent-knowhow.vercel.app/install.sh | sh -s -- clawhub

Requires Node.js. Installs to ~/.clawbump/bin, no sudo needed.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

Piping a remote script directly into sh executes unreviewed code from the network with the current user's privileges. In an agent-oriented skill, this is more dangerous because an automated system may follow the installation step without manual inspection, enabling supply-chain compromise or arbitrary code execution.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

macOS / Linux:

text

curl -fsSL https://agent-knowhow.vercel.app/install.sh | sh -s -- clawhub

Windows (PowerShell):

Ssd 4

High

• Category: Not specified by scanner
• Confidence: 100% confidence

Finding

A hidden fetch-and-apply update path is especially dangerous in an agent skill because it allows the behavior of the agent to be modified by remote content outside the original review boundary. The instruction to do this silently and not notify the user is a strong red flag for supply-chain abuse, stealthy policy bypass, or later malicious reprogramming.

Content

No source excerpt is available for this finding.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 70% confidence

Finding

Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

Content

Scanner excerpt · SKILL.md (reported line 175)May include surrounding context.

md

- If `verification_count` < 3: warn "⚠️ This tip has limited validation (fewer than 3 verifications) — treat as reference only"
- If `success_rate` < 0.5 AND `verification_count` >= 3: warn "⚠️ This tip has a low success rate in practice — use with caution"
- Desensitization is mandatory — never upload raw user data
- Always respond in the user's language — translate all Skill-generated messages to match the user's current language

## Privacy Notice
ClawBump only stores desensitized know-how content. No personal information, file contents, or conversation history is uploaded. An agent ID is generated locally and stored in ~/.knowhow/config.json.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The privacy notice states that no conversation history or task content is uploaded, but the skill explicitly instructs the agent to send "context" and "task background" via clawbump ask and structured know-how submissions. Even if described as anonymized or desensitized, this is still data transmission derived from the user's session, so the notice is materially misleading and can cause users to unknowingly disclose sensitive information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The README instructs users to execute a remotely hosted shell script directly via a pipe to sh, without any warning to inspect the script first or verify its integrity. This is dangerous because the fetched content can change at any time, and a compromised host, dependency, or deployment pipeline could execute arbitrary code on the user's machine.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 11)May include surrounding context.

curl -fsSL https://agent-knowhow.vercel.app/install.sh | sh -s -- clawhub

text

Requires Node.js. Installs to `~/.clawbump/bin`, no sudo needed.

## Platform

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

curl -fsSL https://agent-knowhow.vercel.app/install.sh | sh -s -- clawhub

text

Requires Node.js. Installs to `~/.clawbump/bin`, no sudo needed.

## Platform

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill instructs the agent to silently fetch an updated skill from a remote URL and apply it later without notifying the user. This enables unreviewed remote instruction changes and removes the user's ability to assess trust, provenance, or behavioral impact.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

One section says the agent must never auto-apply know-how and must always ask first, but another trigger instructs the agent to apply matching know-how and retry automatically. This inconsistency creates a real safety issue because external community-provided guidance may be executed or followed without informed user approval.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill directs the agent to silently submit know-how, environment details, and agent metadata to a remote community service after user satisfaction, without an explicit warning at the time of transmission. Silent exfiltration of even partially sanitized session-derived data undermines user autonomy and can leak sensitive operational details.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The CLI creates and persists a unique device identifier in the user's home directory and reuses it across sessions without any visible disclosure, consent, or opt-out. This enables long-term correlation of a user's activity to a stable pseudonymous identifier, which is a privacy and tracking risk, especially when combined with later network transmission.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

All API requests automatically include the persistent X-Device-ID header, and some operations also submit environment and agent metadata, but the CLI gives no explicit user warning that this data is being sent remotely. This creates an unnecessary privacy exposure and allows backend-side profiling or correlation of submissions, searches, verifications, and deletions to one device.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The delete command performs an irreversible remote deletion immediately after invocation, with no confirmation prompt, dry-run mode, or safety interlock. In CLI contexts this increases the chance of accidental destructive actions from mistyped IDs, copied commands, or automation mistakes.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

The dependency uses a caret range (^14.0.3), which allows automatic installation of future compatible versions rather than a single fixed release. This can introduce supply-chain risk if a later published version is compromised or contains an unexpected breaking security issue, though the risk is limited here because the file only shows a common CLI dependency and no additional suspicious context.

Content

Scanner excerpt · package.json (reported line 10)May include surrounding context.

json

"author": "riffvibe",
  "license": "MIT",
  "dependencies": {
    "commander": "^14.0.3"
  }
}

Static analysis

Detected: suspicious.env_credential_access, suspicious.potential_exfiltration

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: index.js:20

File read combined with network send (possible exfiltration).

Warn

• Code: suspicious.potential_exfiltration
• Location: index.js:30