Skill Explorer

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:40 AM UTC
• Version: 1.0.0

Overview

This is a legitimate skill-discovery helper, but its review workflow can force-install unreviewed third-party skills locally before they have been inspected.

Install only if you are comfortable reviewing third-party skills in an isolated environment. Do not run the helper script's `download` action against unknown or suspicious skills on your main machine; prefer a container or VM, avoid `--force`, and use a download-only or static unpacking path before any install.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/explore.sh:40
• Finding: Untrusted Skills Are Force-Installed Before Security Review<![CDATA[ ## Vulnerability Details **File Location**: `scripts/explore.sh:40-44` **Vulnerability Type**: Unsafe installation of an untrusted third-party component **Risk Level**: Medium ### Complete Code Snippet ```bash mkdir -p "$WORK_DIR" cd "$WORK_DIR" clawhub install "$SKILL_NAME" --force 2>&1 || { echo "⚠️ May need --force for suspicious skills" ``` The same unsafe workflow is recommended in `SKILL.md:96-102`: ```bash # Install to temp directory for inspection cd /tmp && mkdir skill-check cd skill-check && clawhub install <skill-name> ``` ### Technical Analysis The Skill's purpose is to assess third-party Skills before recommending or approving their installation. However, the implementation invokes `clawhub install`—including the `--force` option—before conducting the static security analysis. Installation is a higher-privilege and higher-impact operation than downloading and unpacking an artifact for inspection. If the ClawHub installation process executes package hooks, interprets package-controlled installation instructions, resolves additional dependencies, or writes files outside the review directory, malicious behavior could occur before the analyzer examines the files. The `--force` option further weakens safety controls by potentially overriding warnings, conflicts, or protections. This behavior exceeds the minimum privileges needed for static review. No malicious dependency is embedded in this project, but the workflow creates a supply-chain exposure when it processes attacker-controlled Skills. ### Attack Path 1. An attacker publishes or compromises a Skill available through ClawHub. 2. The malicious Skill is made relevant to a search performed through this exploration workflow. 3. A user runs: ```bash ./explore.sh <malicious-skill> download ``` 4. The script invokes: ```bash clawhub install "<malicious-skill>" --force ``` 5. If ClawHub processes executable installation behavior, unsafe metadata, or dependency h ...[truncated 874 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace installation-before-review with a non-executing download mechanism that retrieves an immutable archive without running package hooks. 2. Pin the exact Skill version and verify its publisher, checksum, and signature before unpacking it. 3. Unpack the artifact in a newly created sandbox with: - No inherited credentials - No unnecessary network access - Read-only access to unrelated host files - Resource and execution restrictions 4. Perform static inspection before invoking any installer or package-controlled command. 5. Remove `--force`; warnings and policy failures should stop the workflow rather than be bypassed. 6. Require explicit user approval after the security report and before installation. 7. If ClawHub provides no download-only command, run the installer inside a disposable container or virtual machine and export only the reviewed source files. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/explore.sh:8
• Finding: Predictable Shared Temporary Directory Permits Local Path Manipulation<![CDATA[ ## Vulnerability Details **File Location**: `scripts/explore.sh:8`, used at `scripts/explore.sh:40-41` **Vulnerability Type**: Predictable and insecure temporary directory creation **Risk Level**: Medium ### Complete Code Snippet ```bash WORK_DIR="/tmp/skill-explore-$(date +%s)" ``` The predictable path is subsequently created and entered without verifying ownership or rejecting symbolic links: ```bash mkdir -p "$WORK_DIR" cd "$WORK_DIR" ``` ### Technical Analysis The script constructs a temporary directory using only the current Unix timestamp. This value is predictable and has one-second granularity. On a multi-user system, another local user can anticipate or observe the target path and create it before the script does. Because `mkdir -p` accepts an already-existing directory and `cd` follows symbolic links, the script does not establish that the resulting working directory was freshly and securely created by the current process. A local attacker could pre-create the path as a directory they control or as a symbolic link to another directory. The subsequent forced Skill installation then operates within the attacker-selected location. This creates opportunities for installation output manipulation, file replacement, race conditions, and interference with the security review. ### Attack Path 1. A local attacker predicts the timestamp when the victim will run the script. 2. The attacker creates the expected path before execution, for example: ```bash ln -s /attacker/controlled/directory /tmp/skill-explore-<timestamp> ``` 3. The victim runs the script's `download` action during that second. 4. `mkdir -p "$WORK_DIR"` does not securely claim a unique directory. 5. `cd "$WORK_DIR"` follows the attacker-created path. 6. `clawhub install "$SKILL_NAME" --force` writes into or otherwise operates from the attacker-controlled directory. 7. The attacker can tamper with downloaded files or influence what is later reviewed by the `analyze` act ...[truncated 723 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Create the working directory atomically with `mktemp`, for example: ```bash WORK_DIR="$(mktemp -d "${TMPDIR:-/tmp}/skill-explore.XXXXXXXX")" ``` 2. Fail immediately if secure directory creation is unsuccessful: ```bash WORK_DIR="$(mktemp -d "${TMPDIR:-/tmp}/skill-explore.XXXXXXXX")" || exit 1 ``` 3. Apply restrictive permissions: ```bash chmod 700 "$WORK_DIR" ``` 4. Verify that the directory is owned by the current user and is not a symbolic link before use. 5. Register a cleanup handler: ```bash trap 'rm -rf -- "$WORK_DIR"' EXIT INT TERM ``` 6. Keep downloaded artifacts and analysis results in the same securely created directory to prevent substitution between workflow phases. 7. Prefer an isolated container or private runtime directory when examining potentially malicious Skills. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Ae1

High

• Category: analysis-evasion

Content

- `SKILL.md` - Main documentation

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill instructs users to install third-party skills into a local temporary directory for inspection, but it does not warn that installation itself may execute package hooks, downloader logic, or other untrusted code depending on the package manager or skill ecosystem. In a security-review workflow, this omission is especially dangerous because it normalizes executing the very artifact being assessed before establishing sandboxing or a non-executing extraction method.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script downloads and installs a remote skill into the local filesystem under /tmp and explicitly uses `clawhub install "$SKILL_NAME" --force`, which bypasses normal caution around suspicious packages. In a security-review helper, automatically force-installing untrusted content is dangerous because it modifies the analyst's machine and may trigger package-manager side effects before the skill has been reviewed.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The skill tells users to update EVOLUTION.md and save reports, which are state-changing filesystem operations, without explicitly warning that these steps modify local project files and may persist incorrect or sensitive information. While ordinary in documentation, the lack of notice can still cause unintended project-state changes, particularly when used by automated agents operating with write access.

Static analysis

No suspicious patterns detected.