ClawHub
Back to skill

Security audit

技能检索

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly transparent about ranking and installing skills, but it can install third-party skills from unverified remote catalog data with too little provenance or confirmation.

Review this carefully before installing. Use dry-run first, verify the skill name and publisher outside the ranking output, and avoid running non-dry-run installs for untrusted catalog entries. Do not use custom API endpoints unless you trust them, and treat the local ranking database as unverified recommendation data rather than a security signal.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
scripts/skill-rank.py:248
Finding

Unverified third-party catalog data can influence skill installation

Content
View full analysis
List[Dict]: """Fetch skills from Tencent SkillHub API.""" skills = [] try: print("Fetching from Tencent SkillHub API...") api_url = config.get( "tencent_api_url", DEFAULT_CONFIG["tencent_api_url"] ) page = 1 page_size = 100 total_fetched = 0 while True: url = ( f"{api_url}?page={page}" f"&pageSize={page_size}&sortBy=downloads" ) req = Request(url, headers={ "Accept": "application/json", "User-Agent": "OpenClaw-SkillRank/1.0" }) with urlopen(req, timeout=30) as response: data = json.loads(response.read().decode("utf-8")) if data.get("code") != 0: print( f" API error: " f"{data.get('message', 'Unknown error')}" ) break skills_data = data.get("data", {}).get("skills", []) if not skills_data: break for skill in skills_data: skills.append({ "name": skill.get( "slug", skill.get("name", "") ), "description": ( skill.get("description_zh") or skill.get("description", "") ), "downloads": skill.get("downloads", 0), "stars": skill.get("st ...[truncated 3712 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/skill-rank.py:209
Finding

Configurable API endpoints permit unrestricted outbound requests

Content
View full analysis
Dict: """Load configuration from file.""" if CONFIG_PATH.exists(): with open(CONFIG_PATH) as f: config = json.load(f) return {**DEFAULT_CONFIG, **config} return DEFAULT_CONFIG ``` ```python def fetch_xfyun_skillhub(config: Dict) -> List[Dict]: """Fetch skills from Xfyun SkillHub API.""" skills = [] try: print("Fetching from Xfyun SkillHub API...") api_url = config.get( "xfyun_api_url", DEFAULT_CONFIG["xfyun_api_url"] ) url = f"{api_url}?limit=1000" req = Request(url, headers={ "Accept": "application/json", "User-Agent": "OpenClaw-SkillRank/1.0" }) with urlopen(req, timeout=30) as response: data = json.loads(response.read().decode("utf-8")) ``` ```python def fetch_tencent_skillhub(config: Dict) -> List[Dict]: """Fetch skills from Tencent SkillHub API.""" skills = [] try: print("Fetching from Tencent SkillHub API...") api_url = config.get( "tencent_api_url", DEFAULT_CONFIG["tencent_api_url"] ) page = 1 page_size = 100 total_fetched = 0 while True: url = ( f"{api_url}?page={page}" f"&pageSize={page_size}&sortBy=downloads" ) req = Request(url, headers={ "Accept": "application/json", "User-Agent": "OpenClaw-SkillRank/1.0" }) with urlopen(req, timeout=30) as response: data = json.loads(response.read().decode("utf-8")) ``` ### Technical Analysis The c ...[truncated 2402 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (27)

Tainted flow: 'req' from os.environ.get (line 259, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/skill-rank.py (reported line 218)May include surrounding context.

python
"User-Agent": "OpenClaw-SkillRank/1.0"
        })
        
        with urlopen(req, timeout=30) as response:
            data = json.loads(response.read().decode('utf-8'))
        
        items = data.get("items", [])

Tainted flow: 'req' from os.environ.get (line 259, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/skill-rank.py (reported line 264)May include surrounding context.

python
"User-Agent": "OpenClaw-SkillRank/1.0"
        })
        
        with urlopen(req, timeout=30) as response:
            data = json.loads(response.read().decode('utf-8'))
        
        items = data.get("items", [])

Tp4

High
Category
MCP Tool Poisoning
Confidence
89% confidence
Finding

The skill claims broad multi-platform ranking and installation behavior, but the analyzed content does not clearly substantiate those capabilities. This mismatch is dangerous because users and orchestrators may trust the declared functionality and authorize actions under false assumptions, reducing transparency around what the skill really does.

Content

No source excerpt is available for this finding.

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · scripts/skill-rank.py (reported line 191)May include surrounding context.

python
cursor = conn.cursor()
    
    cursor.execute('''
        UPDATE skills SET rank = (
            SELECT COUNT(*) + 1 FROM skills s2 
            WHERE s2.total_score > skills.total_score
        )

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · scripts/skill-rank.py (reported line 343)May include surrounding context.

python
# ============== Commands ==============

def cmd_update(args):
    """Update skill database from all sources."""
    print("="*60)
    print("Updating Skill Database")
    print("="*60 + "\n")

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · scripts/skill-rank.py (reported line 793)May include surrounding context.

python
# ============== Commands ==============

def cmd_update(args):
    """Update skill database from all sources."""
    print("="*60)
    print("Updating Skill Database")
    print("="*60 + "\n")

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill’s stated role is ranking and discovery, but it also performs one-click installation by invoking external package-manager-like CLIs. In this context, remote catalog data influences a code-installation path, making the skill materially more dangerous because users may treat rankings as trust signals and install potentially malicious skills without adequate review.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · test_skill_rank.py (reported line 11)May include surrounding context.

python
def run_command(cmd):
    """Run a command and return output."""
    result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
    return result.returncode, result.stdout, result.stderr

def test_help():

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill advertises capabilities that include network access, local file access, environment access, and shell execution, but it does not declare any explicit tool scope or permissions boundary. In a skill that can update databases and install other skills, this creates unnecessary ambiguity and increases the chance of over-privileged execution or unsafe downstream behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger phrases are very broad and include common recommendation and search language, which can cause the skill to activate in situations where the user did not intend to invoke it. Because this skill can lead into network access, local scanning, and potential installation flows, accidental activation increases the risk of unintended data access or system-changing suggestions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill documents installation of skills and global npm packages, including commands that can change the host environment, but it does not present a clear warning or mandatory confirmation step. In this context, installation is especially sensitive because it can introduce untrusted third-party code and persistent system modifications.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

L03 的描述写明“当用户询问如何做某事、寻找某技能或希望扩展功能时”即触发，这些条件覆盖面非常广，和普通求助或探索性对话高度重叠。该条目未给出明确边界、限定上下文或排除情形，容易造成非预期调用。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

L24 使用“当用户希望创建新技能（或更新现有技能）……时使用”这类自然语言条件，但未定义如何判断“希望”、何时应转为普通建议而非调用该技能。缺少具体触发短语、上下文限制或排除条件，使激活标准偏模糊。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

L25 将适用场景描述为“识别重复任务、跨工具搭建流程、配置触发器与动作、优化现有自动化等场景”，这些表述较宽泛，涵盖大量常见工作讨论。未说明触发需要哪些明确请求、工具前提或不适用情形，存在误触发风险。

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The architecture describes a system centered on ClawHub and GitHub discovery, while the skill metadata claims support for Tencent SkillHub, Xfyun SkillHub, and local skills. This mismatch can mislead users and reviewers about what data sources are actually queried and what trust boundaries exist, increasing the chance of unintended remote access, incomplete coverage, or installation decisions based on inaccurate assumptions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The design includes scanning local skill directories, fetching remote repository content, and recommending use of a GitHub token, but it does not describe user consent, data minimization, or credential-handling safeguards. In a skill-discovery tool, this creates privacy and security risk because local inventory and authenticated network access may expose sensitive metadata or encourage unsafe token use without clear warnings.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/architecture.md (reported line 110)May include surrounding context.

skills table

sql
CREATE TABLE skills (
    name TEXT PRIMARY KEY,
    repo_url TEXT,
    description TEXT,

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The manifest describes a multi-platform skill ranking system for Tencent, Xfyun, and local skills, but the configuration also pulls GITHUB_TOKEN from the environment. No GitHub-based ranking/fetching behavior is implemented in this file, so accessing or encouraging use of a separate credential is unjustified by the stated purpose here.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/skill-rank.py (reported line 617)May include surrounding context.

python
def check_cli_installed(cli_name: str) -> bool:
    """Check if a CLI tool is installed."""
    try:
        result = subprocess.run([cli_name, '--version'], capture_output=True, text=True, timeout=5)
        return result.returncode == 0
    except (FileNotFoundError, subprocess.TimeoutExpired):
        return False

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/skill-rank.py (reported line 687)May include surrounding context.

python
# Show CLI version
    try:
        version_result = subprocess.run([cli_name, '--version'], capture_output=True, text=True, timeout=5)
        if version_result.returncode == 0:
            print(f"📋 Using {cli_name} {version_result.stdout.strip()}")
    except:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The installation flow executes external install commands immediately after lookup, without a confirmation prompt or trust review, even though the skill database is populated from remote sources. In a discovery/recommendation context, this is dangerous because users may be socially engineered into installing malicious or typosquatted skills through a convenience feature that directly triggers software installation.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
88% confidence
Finding

This code executes an external installer CLI to install software selected from remotely sourced skill metadata, with no trust verification, confirmation gate, or provenance checks. While it does not use a shell and is not classic command injection, it still enables execution of untrusted third-party package installation workflows from a discovery/ranking tool, which can lead to arbitrary code execution or supply-chain compromise.

Content

Scanner excerpt · scripts/skill-rank.py (reported line 699)May include surrounding context.

python
try:
        # Run with real-time output
        process = subprocess.Popen(
            cmd,
            stdout=subprocess.PIPE,
            stderr=subprocess.STDOUT,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · test_skill_rank.py (reported line 11)May include surrounding context.

python
def run_command(cmd):
    """Run a command and return output."""
    result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
    return result.returncode, result.stdout, result.stderr

def test_help():

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The update workflow fetches data from external services without clearly warning users that network requests will occur and that local metadata may be created or refreshed. While lower severity than installation, silent external access can still affect privacy expectations and expose usage patterns or local context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

该 JSON 文件中的 description 字段整体以中文表述，但未见任何说明表明这是面向特定中文用户群、区域合规场景，或允许用户选择其他语言。按规则，若技能内容强制单一语言且无用户选择或明确正当说明，可构成语言/locale 策略问题。

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.