Security audit

OpenClaw Skill Publisher

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent publishing guide, but it gives users high-impact commands for public publishing, token login, global installs, and shell execution without enough safeguards.

Review this skill carefully before installing. Use it only in a controlled publishing environment, verify the target account and repository visibility, scan content for secrets before upload, avoid pasting tokens into shared transcripts or command history, and prefer pinned/local tool installs plus structured command invocation over the provided cmd string templates.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:41
Finding: Unpinned Global Installation of a Mutable Third-Party Package
Content: View full analysis
Remediation: View remediation
``` 2. Record and periodically review the expected package version and provenance. 3. Use npm lockfiles and integrity metadata where the installation model permits them. 4. Prefer a project-local installation over a global installation when possible: ```powershell npm install --save-exact clawhub@ ``` 5. Invoke the locally installed executable through a controlled package script or its explicit path. 6. Review package lifecycle scripts before installation and consider disabling them when they are not required: ```powershell npm install --ignore-scripts --save-exact clawhub@ ``` 7. Verify that disabling lifecycle scripts is compatible with the package before recommending that option. 8. Upgrade only after reviewing the new version rather than automatically resolving the latest release. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:68
Finding: Command Injection Risk in Dynamically Constructed cmd.exe Publishing Commands
Content: View full analysis
--slug --name ""<显示名>"" --version <版本号> --tags <标签> --changelog ""<变更说明>"" --no-input" ``` The update example uses the same construction: ```powershell cmd /c "set PATH=...&& clawhub publish <路径> --slug --name ""<名称>"" --version 1.0.1 --tags latest --changelog ""修复xxx"" --no-input" ``` The command reference also constructs a composite command string: ```powershell & "$CMD clawhub publish <路径> --slug --name ""<名>"" --version --tags latest --changelog ""<说明>"" --no-input" ``` ### Technical Analysis The skill builds a complete `cmd.exe` command by interpolating skill paths and publication metadata into a string. Values such as the skill directory, slug, display name, tags, and changelog may originate from user requests or package metadata. Several substituted fields are unquoted, while the quoted fields rely on fragile nested quoting. `cmd.exe` treats metacharacters such as `&`, `|`, `<`, `>`, `^`, `%`, and quote characters as command syntax. If an untrusted value reaches the template without strict validation and correct escaping, it can terminate or alter the intended `clawhub` invocation and append another command. The risk is especially direct for the unquoted skill path and slug fields. A maliciously named directory or crafted slug containing command separators can be interpreted by `cmd.exe` rather than passed as a literal argument to `clawhub`. ### Attack Path 1. An attacker supplies a skill directory, slug, tag, display name, or changelog containing `cmd.exe` metach ...[truncated 1507 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The trigger phrases are broad and include common terms like '安装clawhub' and '技能包管理' without clear exclusions. This can cause the skill to activate in contexts that merely mention adjacent topics, leading an agent to surface powerful publishing, login, and repository-modification instructions when they were not specifically requested. Because the skill includes external distribution and credential-related actions, overbroad activation raises real misuse risk.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill explicitly recommends using cmd /c to bypass PowerShell execution-policy restrictions. Even if framed as a workaround for packaging tools, this normalizes circumvention of a host security control and can be repurposed to run other blocked scripts or tooling in the same environment. In a publishing skill, that capability is broader than necessary and increases the chance of unsafe command execution.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: These instructions direct the user to authenticate with a publishing service using a token and perform account actions, but they do not warn about credential handling, command-history exposure, or the consequences of authenticating in a shared or logged environment. In a skill intended for automated assistance, omission of these warnings makes accidental secret disclosure and unintended publication more likely.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill provides direct commands to create repositories, upload contents, and change repository visibility to public, but it does not present a clear warning that these actions can disclose proprietary code or make data publicly accessible. In context, this is especially dangerous because the skill also discusses packaging and generalized publication workflows, so users may execute these commands on real project assets without recognizing the permanence and exposure risk.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill embeds account-specific identities and indicates the existence of a configured Gitee token. While it does not expose the token value directly, publishing account metadata and token-state information in reusable skill documentation leaks operational details that can aid targeting, social engineering, or accidental publication under the wrong account.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.