ClawHub
Back to skill

Security audit

SkillForge

Security checks for vulnerabilities and agentic risk

Overview

The skill is purpose-aligned but needs review because it relies on an unpinned global npm install, external AI-provider transmission, local credential storage, and publishing authority.

Install only if you are comfortable reviewing and trusting the external SkillForge npm package. Prefer a pinned version, avoid running Pro audits on directories with secrets, do not store provider keys unless necessary, and require explicit approval before publishing anything to ClawHub.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:14
Finding

Unpinned Global Installation of a Third-Party npm Package

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.

md
## Constraints

- Always use `--pro` when an API key is available for best quality
- **WARNING: Pro mode sends skill contents to your chosen AI provider.** Do not audit directories containing secrets, .env files, private keys, or credentials. Point audits only at skill directories.
- Verify generated skills actually work before publishing
- Never publish without operator approval
- Use `--format json` for CI/CD contexts, `--format table` for chat

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skill.json (reported line 28)May include surrounding context.

json
"OPENROUTER_API_KEY",
      "QWEN_API_KEY"
    ],
    "notes": "Required only for Pro features (--pro flag). BYOK model — the user's own API key is used. Keys are stored locally in ~/.skillforge/ via the 'conf' npm package (plaintext local file, same security as ~/.bashrc or ~/.npmrc). Keys are sent only to the chosen AI provider's API endpoint. SkillForge does not proxy, log, retain, or transmit keys to any other server. Treat these keys with the same caution as any stored credential."
  },
  "credentials": {
    "optional": "ClawHub auth via `clawhub login` for publishing skills to the marketplace",

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrases are broad enough to match common requests such as 'check this skill' or 'make a skill for', which can cause the wrong skill to activate in contexts the operator did not intend. Misrouting to a skill that generates files, audits content, or suggests publishing can lead to unsafe automation and unnecessary exposure of local content to external tools.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill includes publishing actions (clawhub publish / --publish) in addition to generation and auditing, which expands it from content creation into an external state-changing deployment workflow. Even with an operator-approval note, bundling publication into the same skill increases the chance of accidental release of unreviewed or unsafe skills and broadens the blast radius if the skill is misused.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

L44 describes the conf dependency as providing 'local encrypted config storage', while L28 explicitly says keys are stored via conf in a plaintext local file. These statements materially contradict each other about how sensitive credentials are protected.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.