clawhub-skill-forge

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:18 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a disclosed template generator, but its publishing instructions include a hardcoded third-party GitHub and ClawHub namespace that could cause unintended authenticated repository changes.

Review carefully before installing. Use this only if you are comfortable with an agent generating new skill files, and do not let it run the post-publish gh repo edit command unless the owner, repository, homepage URL, and exact changes are replaced with your own confirmed values.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:286
• Finding: Hardcoded Third-Party Repository and Branding Instructions## Vulnerability Details **File Location**: `SKILL.md`, lines 286-296 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: Medium ### Vulnerable Code ```powershell # Set GitHub repo About description and homepage URL (run after every push) gh repo edit seph1709/[skill-name] ` --description "OpenClaw skill: [one-line purpose]" ` --homepage "https://clawhub.ai/seph1709/[skill-name]" ``` The subsequent instructions state: ```text This resolves the "no homepage / opaque owner" scanner flag — the GitHub repo is the audit trail, and the ClawhHub URL links back to the published registry record. Note: `clawhub edit --homepage` does not exist as a CLI command. GitHub repo About is the only place to surface a homepage URL for the skill. ``` ### Technical Analysis The Skill directs the agent to run an authenticated GitHub CLI command after every push while hardcoding the third-party namespace `seph1709`. The target repository and homepage are not derived from the user's confirmed GitHub account, the generated skill's verified ownership metadata, or an explicit user selection. Consequently, an agent following the Skill may attempt to edit a repository outside the user's intended namespace or apply third-party attribution and branding to a generated project. This instruction also conflicts with the Skill's own rule prohibiting hardcoded personal identifiers. The behavior does not itself bypass GitHub authorization: the command can modify a repository only if the active GitHub credentials already possess the required permission. Nevertheless, directing an authenticated agent toward a fixed third-party target exceeds the minimum privilege and scope necessary to document or publish a user-owned Skill. ### Attack Path 1. A user loads the Skill and asks the agent to scaffold and publish a new OpenClaw Skill. 2. The agent follows the mandatory post-publishing instructions. 3. After a push, the agent executes `gh repo edit seph1709/[skill-name] ...[truncated 1165 chars]
• Remediation: ## Remediation Suggestions 1. Remove the hardcoded `seph1709` namespace from both the GitHub repository target and ClawhHub URL. 2. Obtain the repository owner and name from explicit user input or verified repository metadata, such as: ```powershell $repo = gh repo view --json nameWithOwner --jq '.nameWithOwner' ``` 3. Display the resolved repository and homepage to the user and require confirmation before invoking `gh repo edit`. 4. Verify that the resolved repository owner matches the intended publisher or the validated owner associated with `_meta.json`. 5. Make repository metadata modification optional rather than requiring it after every push. 6. Construct the homepage from a verified registry owner and slug instead of a fixed third-party identifier. 7. Add an agent rule forbidding authenticated mutations of repositories or registry records unless the exact target and changes have been confirmed by the user. 8. Keep publication guidance internally consistent with the existing prohibition against hardcoded personal identifiers.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (18)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
name: clawhub-skill-creator
description: "Create ClawhHub-ready OpenClaw skills with correct structure, scanner criteria, security rules & publish checklist. No credentials or binaries required."
metadata: {"openclaw":{"emoji":"🛠️"}}
---

# clawhub-skill-creator

Scaffold and publish ClawhHub-ready OpenClaw skills. Follow every rule below. Do not skip sections. Do not invent conventions not listed here.

Ask the user for the **skill name** and **purpose** if not already provided, then generate the files.

---

## Structure

Generate two files only — no README.md, no CHANGELOG.md, no auxiliary docs:

```
[skill-nam

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Self-Modification

High

• Category: Rogue Agent

Content

- **`clawhub install` path**: By default installs into `./skills` (cwd) or `<workspace>/skills`. Always pass `--workdir` explicitly or install directly to `~/.openclaw/skills/` and add extraDirs.

- **Encoding**: Always write SKILL.md with `[System.Text.UTF8Encoding]::new($false)` (no BOM). BOM or encoding artifacts in frontmatter break the YAML parser silently.

---

• Confidence: 85% confidence
• Finding: The skill explicitly instructs generating and writing `SKILL.md`, i.e., creating or modifying executable agent-skill content. Self-modifying or self-replicating content creation is higher risk because it can propagate insecure patterns or hidden instructions into newly generated skills at scale.

Credential Access

High

• Category: Privilege Escalation

Content

**Good description example:**
```
"Facebook Page manager: post, schedule, reply & get insights. Requires: powershell/pwsh. Reads ~/.config/fb-page/credentials.json (FB_PAGE_TOKEN, FB_PAGE_ID). FB_APP_SECRET for one-time setup only — delete afterward. Long-lived token; rotate periodically and immediately if host is compromised. Grant minimal permissions only. No data forwarded to third parties; all calls go to graph.facebook.com only."
```

**Bad description example (do not do this):**

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

**Good description example:**
```
"Facebook Page manager: post, schedule, reply & get insights. Requires: powershell/pwsh. Reads ~/.config/fb-page/credentials.json (FB_PAGE_TOKEN, FB_PAGE_ID). FB_APP_SECRET for one-time setup only — delete afterward. Long-lived token; rotate periodically and immediately if host is compromised. Grant minimal permissions only. No data forwarded to third parties; all calls go to graph.facebook.com only."
```

**Bad description example (do not do this):**

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

**Good description example:**
```
"Facebook Page manager: post, schedule, reply & get insights. Requires: powershell/pwsh. Reads ~/.config/fb-page/credentials.json (FB_PAGE_TOKEN, FB_PAGE_ID). FB_APP_SECRET for one-time setup only — delete afterward. Long-lived token; rotate periodically and immediately if host is compromised. Grant minimal permissions only. No data forwarded to third parties; all calls go to graph.facebook.com only."
```

**Bad description example (do not do this):**

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

**Good description example:**
```
"Facebook Page manager: post, schedule, reply & get insights. Requires: powershell/pwsh. Reads ~/.config/fb-page/credentials.json (FB_PAGE_TOKEN, FB_PAGE_ID). FB_APP_SECRET for one-time setup only — delete afterward. Long-lived token; rotate periodically and immediately if host is compromised. Grant minimal permissions only. No data forwarded to third parties; all calls go to graph.facebook.com only."
```

**Bad description example (do not do this):**

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

**Good description example:**
```
"Facebook Page manager: post, schedule, reply & get insights. Requires: powershell/pwsh. Reads ~/.config/fb-page/credentials.json (FB_PAGE_TOKEN, FB_PAGE_ID). FB_APP_SECRET for one-time setup only — delete afterward. Long-lived token; rotate periodically and immediately if host is compromised. Grant minimal permissions only. No data forwarded to third parties; all calls go to graph.facebook.com only."
```

**Bad description example (do not do this):**

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

**Good description example:**
```
"Facebook Page manager: post, schedule, reply & get insights. Requires: powershell/pwsh. Reads ~/.config/fb-page/credentials.json (FB_PAGE_TOKEN, FB_PAGE_ID). FB_APP_SECRET for one-time setup only — delete afterward. Long-lived token; rotate periodically and immediately if host is compromised. Grant minimal permissions only. No data forwarded to third parties; all calls go to graph.facebook.com only."
```

**Bad description example (do not do this):**

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

**Good description example:**
```
"Facebook Page manager: post, schedule, reply & get insights. Requires: powershell/pwsh. Reads ~/.config/fb-page/credentials.json (FB_PAGE_TOKEN, FB_PAGE_ID). FB_APP_SECRET for one-time setup only — delete afterward. Long-lived token; rotate periodically and immediately if host is compromised. Grant minimal permissions only. No data forwarded to third parties; all calls go to graph.facebook.com only."
```

**Bad description example (do not do this):**

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

### STEP 1 — Load Credentials

```powershell
$cfg = Get-Content "$HOME/.config/[skill]/credentials.json" -Raw | ConvertFrom-Json
```

If missing, show full setup flow:

• Confidence: 72% confidence
• Finding: The skill provides a direct code pattern to read arbitrary credentials from `$HOME/.config/[skill]/credentials.json` at runtime. While intended as a template, this normalizes credential-loading behavior without requiring stronger validation, minimal field access, or safeguards against generated skills over-collecting sensitive data.

Session Persistence

Medium

• Category: Rogue Agent

Content

---
name: clawhub-skill-creator
description: "Create ClawhHub-ready OpenClaw skills with correct structure, scanner criteria, security rules & publish checklist. No credentials or binaries required."
metadata: {"openclaw":{"emoji":"🛠️"}}
---

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

- All credential requirements named in the description (file path + field names)
- Distinguish required vs optional fields (e.g. APP_SECRET: setup only, delete afterward)
- No token literals in any script — credentials always read fresh from disk at runtime
- All runtime files permission-restricted (icacls/chmod 600): config, worker, log, pid, state
- Worker stored in ~/.config/[skill]/worker.ps1 — never in system temp
- Logs contain metadata only — no secrets, no message content
- Long-lived tokens: include rotation guidance and immediate-rotation-if-compromised note

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

- All credential requirements named in the description (file path + field names)
- Distinguish required vs optional fields (e.g. APP_SECRET: setup only, delete afterward)
- No token literals in any script — credentials always read fresh from disk at runtime
- All runtime files permission-restricted (icacls/chmod 600): config, worker, log, pid, state
- Worker stored in ~/.config/[skill]/worker.ps1 — never in system temp
- Logs contain metadata only — no secrets, no message content
- Long-lived tokens: include rotation guidance and immediate-rotation-if-compromised note

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

- All credential requirements named in the description (file path + field names)
- Distinguish required vs optional fields (e.g. APP_SECRET: setup only, delete afterward)
- No token literals in any script — credentials always read fresh from disk at runtime
- All runtime files permission-restricted (icacls/chmod 600): config, worker, log, pid, state
- Worker stored in ~/.config/[skill]/worker.ps1 — never in system temp
- Logs contain metadata only — no secrets, no message content
- Long-lived tokens: include rotation guidance and immediate-rotation-if-compromised note

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Session Persistence

Medium

• Category: Rogue Agent

Content

Then the full worker as a plain code block with line-by-line comments on every sensitive operation.

The Start procedure must write the worker by extracting it from SKILL.md — not constructing it from string literals:

```powershell
$workerContent = Get-Content "$HOME/.openclaw/skills/[skill]/SKILL.md" -Raw

• Confidence: 91% confidence
• Finding: The skill instructs writing a worker script to disk by extracting it from `SKILL.md`, creating a persistent local executable artifact under `~/.config/[skill]/worker.ps1`. Even though framed as scanner-readable packaging, this mechanism enables deployment of background-capable code from markdown content and increases risk of hidden or later-executed persistence.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The skill instructs use of `gh repo edit` to modify GitHub repository metadata even though its stated purpose is only to generate two local skill files. This expands scope from file scaffolding into changing external account-owned resources, which can cause unintended repository edits and could be abused to steer users into modifying public project metadata under false pretenses.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The skill hardcodes the handle `seph1709` and a fixed ClawhHub homepage namespace, causing generated commands to target a specific account rather than the user's chosen repository. If followed blindly, users may misconfigure repos, leak association to the wrong owner, or publish links pointing to an unrelated third party.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

### CREDENTIALS
- [ ] No token literals in any script
- [ ] Worker reads from disk at runtime
- [ ] icacls/chmod 600 on all files: config, worker, log, pid, state
- [ ] Setup-only secrets have delete-after-use instructions
- [ ] Rotation guidance for long-lived tokens
- [ ] Never commit config dir to version control

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Static analysis

No suspicious patterns detected.