clawhub-skill-forge

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:18 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a disclosed template generator, but its publishing instructions include a hardcoded third-party GitHub and ClawHub namespace that could cause unintended authenticated repository changes.

Review carefully before installing. Use this only if you are comfortable with an agent generating new skill files, and do not let it run the post-publish gh repo edit command unless the owner, repository, homepage URL, and exact changes are replaced with your own confirmed values.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:286

Finding

Hardcoded Third-Party Repository and Branding Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 286-296
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: Medium

Vulnerable Code

powershell

# Set GitHub repo About description and homepage URL (run after every push)
gh repo edit seph1709/[skill-name] `
  --description "OpenClaw skill: [one-line purpose]" `
  --homepage "https://clawhub.ai/seph1709/[skill-name]"

The subsequent instructions state:

text

This resolves the "no homepage / opaque owner" scanner flag — the GitHub repo is the audit trail, and the ClawhHub URL links back to the published registry record.

Note: `clawhub edit --homepage` does not exist as a CLI command. GitHub repo About is the only place to surface a homepage URL for the skill.

Technical Analysis

The Skill directs the agent to run an authenticated GitHub CLI command after every push while hardcoding the third-party namespace seph1709. The target repository and homepage are not derived from the user's confirmed GitHub account, the generated skill's verified ownership metadata, or an explicit user selection.

Consequently, an agent following the Skill may attempt to edit a repository outside the user's intended namespace or apply third-party attribution and branding to a generated project. This instruction also conflicts with the Skill's own rule prohibiting hardcoded personal identifiers.

The behavior does not itself bypass GitHub authorization: the command can modify a repository only if the active GitHub credentials already possess the required permission. Nevertheless, directing an authenticated agent toward a fixed third-party target exceeds the minimum privilege and scope necessary to document or publish a user-owned Skill.

Attack Path

1. A user loads the Skill and asks the agent to scaffold and publish a new OpenClaw Skill.
2. The agent follows the mandatory post-publishing instructions.
3. After a push, the agent executes `gh repo edit seph1709/[skill-name] ...[truncated 1165 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the hardcoded seph1709 namespace from both the GitHub repository target and ClawhHub URL.
2. Obtain the repository owner and name from explicit user input or verified repository metadata, such as:

   powershell

   $repo = gh repo view --json nameWithOwner --jq '.nameWithOwner'
   

3. Display the resolved repository and homepage to the user and require confirmation before invoking gh repo edit.
4. Verify that the resolved repository owner matches the intended publisher or the validated owner associated with _meta.json.
5. Make repository metadata modification optional rather than requiring it after every push.
6. Construct the homepage from a verified registry owner and slug instead of a fixed third-party identifier.
7. Add an agent rule forbidding authenticated mutations of repositories or registry records unless the exact target and changes have been confirmed by the user.
8. Keep publication guidance internally consistent with the existing prohibition against hardcoded personal identifiers.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (18)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

---

name: clawhub-skill-creator description: "Create ClawhHub-ready OpenClaw skills with correct structure, scanner criteria, security rules & publish checklist. No credentials or binaries required." metadata: {"openclaw":{"emoji":"🛠️"}}

clawhub-skill-creator

Scaffold and publish ClawhHub-ready OpenClaw skills. Follow every rule below. Do not skip sections. Do not invent conventions not listed here.

Ask the user for the skill name and purpose if not already provided, then generate the files.

---

Structure

Generate two files only — no README.md, no CHANGELOG.md, no auxiliary docs:

text

[skill-nam

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

The skill explicitly instructs generating and writing SKILL.md, i.e., creating or modifying executable agent-skill content. Self-modifying or self-replicating content creation is higher risk because it can propagate insecure patterns or hidden instructions into newly generated skills at scale.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

md

- **`clawhub install` path**: By default installs into `./skills` (cwd) or `<workspace>/skills`. Always pass `--workdir` explicitly or install directly to `~/.openclaw/skills/` and add extraDirs.

- **Encoding**: Always write SKILL.md with `[System.Text.UTF8Encoding]::new($false)` (no BOM). BOM or encoding artifacts in frontmatter break the YAML parser silently.

---

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.

Good description example:

text

"Facebook Page manager: post, schedule, reply & get insights. Requires: powershell/pwsh. Reads ~/.config/fb-page/credentials.json (FB_PAGE_TOKEN, FB_PAGE_ID). FB_APP_SECRET for one-time setup only — delete afterward. Long-lived token; rotate periodically and immediately if host is compromised. Grant minimal permissions only. No data forwarded to third parties; all calls go to graph.facebook.com only."

Bad description example (do not do this):

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 136)May include surrounding context.

Good description example:

text

"Facebook Page manager: post, schedule, reply & get insights. Requires: powershell/pwsh. Reads ~/.config/fb-page/credentials.json (FB_PAGE_TOKEN, FB_PAGE_ID). FB_APP_SECRET for one-time setup only — delete afterward. Long-lived token; rotate periodically and immediately if host is compromised. Grant minimal permissions only. No data forwarded to third parties; all calls go to graph.facebook.com only."

Bad description example (do not do this):

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 154)May include surrounding context.

Good description example:

text

"Facebook Page manager: post, schedule, reply & get insights. Requires: powershell/pwsh. Reads ~/.config/fb-page/credentials.json (FB_PAGE_TOKEN, FB_PAGE_ID). FB_APP_SECRET for one-time setup only — delete afterward. Long-lived token; rotate periodically and immediately if host is compromised. Grant minimal permissions only. No data forwarded to third parties; all calls go to graph.facebook.com only."

Bad description example (do not do this):

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 157)May include surrounding context.

Good description example:

text

"Facebook Page manager: post, schedule, reply & get insights. Requires: powershell/pwsh. Reads ~/.config/fb-page/credentials.json (FB_PAGE_TOKEN, FB_PAGE_ID). FB_APP_SECRET for one-time setup only — delete afterward. Long-lived token; rotate periodically and immediately if host is compromised. Grant minimal permissions only. No data forwarded to third parties; all calls go to graph.facebook.com only."

Bad description example (do not do this):

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 206)May include surrounding context.

Good description example:

text

"Facebook Page manager: post, schedule, reply & get insights. Requires: powershell/pwsh. Reads ~/.config/fb-page/credentials.json (FB_PAGE_TOKEN, FB_PAGE_ID). FB_APP_SECRET for one-time setup only — delete afterward. Long-lived token; rotate periodically and immediately if host is compromised. Grant minimal permissions only. No data forwarded to third parties; all calls go to graph.facebook.com only."

Bad description example (do not do this):

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 217)May include surrounding context.

Good description example:

text

"Facebook Page manager: post, schedule, reply & get insights. Requires: powershell/pwsh. Reads ~/.config/fb-page/credentials.json (FB_PAGE_TOKEN, FB_PAGE_ID). FB_APP_SECRET for one-time setup only — delete afterward. Long-lived token; rotate periodically and immediately if host is compromised. Grant minimal permissions only. No data forwarded to third parties; all calls go to graph.facebook.com only."

Bad description example (do not do this):

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 284)May include surrounding context.

Good description example:

text

"Facebook Page manager: post, schedule, reply & get insights. Requires: powershell/pwsh. Reads ~/.config/fb-page/credentials.json (FB_PAGE_TOKEN, FB_PAGE_ID). FB_APP_SECRET for one-time setup only — delete afterward. Long-lived token; rotate periodically and immediately if host is compromised. Grant minimal permissions only. No data forwarded to third parties; all calls go to graph.facebook.com only."

Bad description example (do not do this):

Credential Access

High

• Category: Privilege Escalation
• Confidence: 72% confidence

Finding

The skill provides a direct code pattern to read arbitrary credentials from $HOME/.config/[skill]/credentials.json at runtime. While intended as a template, this normalizes credential-loading behavior without requiring stronger validation, minimal field access, or safeguards against generated skills over-collecting sensitive data.

Content

Scanner excerpt · SKILL.md (reported line 194)May include surrounding context.

STEP 1 — Load Credentials

powershell

$cfg = Get-Content "$HOME/.config/[skill]/credentials.json" -Raw | ConvertFrom-Json

If missing, show full setup flow:

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: clawhub-skill-creator
description: "Create ClawhHub-ready OpenClaw skills with correct structure, scanner criteria, security rules & publish checklist. No credentials or binaries required."
metadata: {"openclaw":{"emoji":"🛠️"}}
---

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

md

- All credential requirements named in the description (file path + field names)
- Distinguish required vs optional fields (e.g. APP_SECRET: setup only, delete afterward)
- No token literals in any script — credentials always read fresh from disk at runtime
- All runtime files permission-restricted (icacls/chmod 600): config, worker, log, pid, state
- Worker stored in ~/.config/[skill]/worker.ps1 — never in system temp
- Logs contain metadata only — no secrets, no message content
- Long-lived tokens: include rotation guidance and immediate-rotation-if-compromised note

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 211)May include surrounding context.

md

- All credential requirements named in the description (file path + field names)
- Distinguish required vs optional fields (e.g. APP_SECRET: setup only, delete afterward)
- No token literals in any script — credentials always read fresh from disk at runtime
- All runtime files permission-restricted (icacls/chmod 600): config, worker, log, pid, state
- Worker stored in ~/.config/[skill]/worker.ps1 — never in system temp
- Logs contain metadata only — no secrets, no message content
- Long-lived tokens: include rotation guidance and immediate-rotation-if-compromised note

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 310)May include surrounding context.

md

- All credential requirements named in the description (file path + field names)
- Distinguish required vs optional fields (e.g. APP_SECRET: setup only, delete afterward)
- No token literals in any script — credentials always read fresh from disk at runtime
- All runtime files permission-restricted (icacls/chmod 600): config, worker, log, pid, state
- Worker stored in ~/.config/[skill]/worker.ps1 — never in system temp
- Logs contain metadata only — no secrets, no message content
- Long-lived tokens: include rotation guidance and immediate-rotation-if-compromised note

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 91% confidence

Finding

The skill instructs writing a worker script to disk by extracting it from SKILL.md, creating a persistent local executable artifact under ~/.config/[skill]/worker.ps1. Even though framed as scanner-readable packaging, this mechanism enables deployment of background-capable code from markdown content and increases risk of hidden or later-executed persistence.

Content

Scanner excerpt · SKILL.md (reported line 248)May include surrounding context.

Then the full worker as a plain code block with line-by-line comments on every sensitive operation.

The Start procedure must write the worker by extracting it from SKILL.md — not constructing it from string literals:

powershell

$workerContent = Get-Content "$HOME/.openclaw/skills/[skill]/SKILL.md" -Raw

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill instructs use of gh repo edit to modify GitHub repository metadata even though its stated purpose is only to generate two local skill files. This expands scope from file scaffolding into changing external account-owned resources, which can cause unintended repository edits and could be abused to steer users into modifying public project metadata under false pretenses.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill hardcodes the handle seph1709 and a fixed ClawhHub homepage namespace, causing generated commands to target a specific account rather than the user's chosen repository. If followed blindly, users may misconfigure repos, leak association to the wrong owner, or publish links pointing to an unrelated third party.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 364)May include surrounding context.

md

### CREDENTIALS
- [ ] No token literals in any script
- [ ] Worker reads from disk at runtime
- [ ] icacls/chmod 600 on all files: config, worker, log, pid, state
- [ ] Setup-only secrets have delete-after-use instructions
- [ ] Rotation guidance for long-lived tokens
- [ ] Never commit config dir to version control

Static analysis

No suspicious patterns detected.