ClawHub
Back to skill

Security audit

Clawhub auto publisher

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed local-skill publishing helper, and the inspected code currently only scans metadata and prints placeholder upload messages.

Before running this skill, use the dry-run mode first and only set CLAWHUB_API_KEY when you intend to publish. The current code does not actually upload anything, but the advertised purpose is bulk marketplace publishing, so future versions should be treated as capable of sending local skill content to ClawHub.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The documented behavior claims automated packaging and marketplace publishing, but the skill metadata and documentation do not transparently declare the filesystem and external-publishing implications. A mismatch between claimed behavior and declared capabilities is dangerous because it can conceal local content enumeration and publication workflows from reviewers and users, leading to unintended disclosure or unauthorized release of local skills.

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill advertises use of an environment variable for authentication (`CLAWHUB_API_KEY`) but does not declare any tool scope or permissions indicating env access. This creates a trust and review gap: consumers cannot easily tell that sensitive credentials are expected or potentially accessible, increasing the risk of accidental secret exposure or undocumented capability use.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill promotes one-click automatic packaging and publishing of local skills without clearly warning that local content, metadata, and version changes may be transmitted to an external marketplace. In this context, the omission is especially risky because the entire purpose of the skill is bulk publication, which can amplify accidental exposure of proprietary, sensitive, or unfinished local assets.

Natural-Language Policy Violations

Medium
Confidence
92% confidence
Finding
The top-level docstring states the skill as "自动上架 skills 到 ClawHub," and all user-facing docstrings/comments are written only in Chinese. For a general-purpose publisher skill, this indicates a language constraint without offering the user a language choice or documenting a justified locale limitation.

Natural-Language Policy Violations

Low
Confidence
89% confidence
Finding
The natural-language instructions and feature descriptions are written in Chinese, while the file does not state that the skill is intentionally region- or locale-specific and does not offer an alternative language option. This may violate a language/locale policy requiring user choice or explicit justification for language constraints.

Static analysis

No suspicious patterns detected.