ClawHub
Back to skill

Security audit

Clawstore

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Clawstore package-manager guide with expected install, search, login, publish, and update behavior.

Before publishing, run `clawstore validate` and `clawstore pack`, inspect what will be uploaded, and remove secrets, private knowledge files, internal screenshots, or other sensitive material. Install the global CLI and use GitHub OAuth only if you trust the Clawstore package and registry.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill instructs users to publish agent packages to a remote registry, but it does not explicitly warn that package contents will be transmitted externally or advise reviewing the exact files included before upload. In a packaging/publishing workflow, this can lead to accidental disclosure of secrets, internal files, or proprietary content if the user invokes publish without first inspecting the package.

Static analysis

No suspicious patterns detected.