ClawHub
Back to skill

Security audit

SkillForge

Security checks for vulnerabilities and agentic risk

Overview

SkillForge appears to be a legitimate skill-building helper, but users should review it because it handles API keys and its credential-storage documentation is inconsistent.

Install only if you are comfortable with a global npm CLI that can store provider API keys locally and send skill contents to your chosen AI provider in Pro mode. Treat stored keys as plaintext unless the publisher corrects the documentation and implements stronger storage, avoid auditing folders that contain secrets, and require explicit approval before publishing anything to ClawHub.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The manifest contains contradictory security claims: the dependency notes describe the config storage as encrypted, while the environment notes explicitly state API keys are stored in plaintext under ~/.skillforge/. Misstating credential protection can cause operators to overtrust the skill and store sensitive API keys under weaker-than-expected local protections, increasing the chance of local credential disclosure.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The manifest description includes very broad trigger phrases such as "create a skill," "generate a skill," and "check this skill," which are common requests that may appear in unrelated contexts. This can cause the skill to activate unexpectedly, increasing the chance that users are routed into installing tools, generating code, or publishing workflows they did not explicitly intend to invoke.

Credential Access

High
Category
Privilege Escalation
Content
"OPENROUTER_API_KEY",
      "QWEN_API_KEY"
    ],
    "notes": "Required only for Pro features (--pro flag). BYOK model — the user's own API key is used. Keys are stored locally in ~/.skillforge/ via the 'conf' npm package (plaintext local file, same security as ~/.bashrc or ~/.npmrc). Keys are sent only to the chosen AI provider's API endpoint. SkillForge does not proxy, log, retain, or transmit keys to any other server. Treat these keys with the same caution as any stored credential."
  },
  "credentials": {
    "optional": "ClawHub auth via `clawhub login` for publishing skills to the marketplace",
Confidence
89% confidence
Finding
The skill explicitly states that API keys are stored locally in plaintext via the conf package. Plaintext credential storage is a real security weakness because any local compromise, overly broad file permissions, backups, or multi-user access could expose provider API keys and enable unauthorized API usage or account abuse. In this context, the skill is a developer tool that encourages users to configure multiple provider keys, which increases the concentration of sensitive secrets on disk.

Static analysis

No suspicious patterns detected.