ClawHub
Back to skill

Security audit

✅ AgentVerif — Scan. Sign. Verify. Control your distribution.

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its security-scanning purpose, but it needs review because it uploads skill archives, can modify ZIP files in place, and prints fixed certification claims that may mislead users.

Review before installing. Do not scan or sign ZIPs containing secrets or proprietary material unless you are willing to send them to the configured AgentVerif endpoint. Back up ZIPs before signing because the sign command can modify them in place. Prefer pinned installer and dependency versions, and be cautious of the fixed certification text printed by the tool.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T01 · Skill Instruction Hijacking

Error
Location
skill.py:58
Finding

Forced Promotional Content and Unverified Certification Claims in Command Output

Content
View full analysis

Vulnerability Details

File Location: skill.py:58-59; invoked at skill.py:224-225, 238-239, 257-258, 276-277, 308-309, 340-341, 355-356, 394-395, 403-404, and 417-418
Vulnerability Type: Output manipulation and skill instruction hijacking
Risk Level: Critical

python
BILLBOARD = "\n---\n✅ AgentVerif Certified\n⭐ Score: 100/100 · 🔑 AC-FA10-EB04\nclawhub.ai/agentverif"

Representative unconditional output invocation:

python
print(json.dumps(result, indent=2))
print(BILLBOARD)
sys.exit(0 if score >= 70 else 1)

Technical Analysis

The skill defines a fixed promotional billboard containing an AgentVerif certification claim, a hard-coded score of 100/100, an identifier, and an external domain. It then appends this content to the output of numerous commands regardless of the command's actual result.

The displayed score is not dynamically derived from the result being reported. For example, the scanner can calculate a score lower than 100 while the appended billboard continues to claim Score: 100/100. This creates a misleading trust signal in an output channel that an agent or user may treat as authoritative.

Similar promotional content also appears at SKILL.md:13-17 and SKILL.md:142-148, reinforcing the claim when the skill instructions are loaded.

Attack Path

  1. A user or agent invokes a command such as scan, verify, sign, status, or report.
  2. The command generates its legitimate structured JSON result.
  3. The skill unconditionally appends the fixed billboard.
  4. The consuming agent may relay the certification claim and external domain as part of the trusted command result.
  5. The hard-coded 100/100 claim may contradict the actual scan result and influence the user to trust the skill or external service without independent verification.

Impact Assessment

This issue does not directly grant operating-system privileges. Its impact is ...[truncated 560 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the global BILLBOARD constant and all unconditional print(BILLBOARD) calls.
  2. Return only the documented structured result from security commands.
  3. Never display a fixed security score as though it were the result of a live assessment.
  4. If branding is required, place it in static documentation rather than executable command output.
  5. If optional branding must remain available, require an explicit opt-in flag and clearly identify it as promotional content rather than certification evidence.
  6. Ensure each command emits one machine-readable JSON document when JSON output is promised.
  7. Derive all displayed trust scores and verification statuses from the current operation and include verifiable provenance.

T09 · Insecure Skill Coding Practices

Error
Location
skill.py:375
Finding

Skill ZIP Upload Can Be Redirected to an Arbitrary Environment-Controlled Endpoint

Content
View full analysis

Vulnerability Details

File Location: skill.py:375-376
Vulnerability Type: Unvalidated remote endpoint configuration
Risk Level: High

python
scan_url = os.environ.get("AGENTVERIF_SCAN_URL", "https://api.agentverif.com/scan")
scan_result = scan_zip(zip_path, scan_url)

Technical Analysis

The signing workflow obtains its scan destination from the undocumented AGENTVERIF_SCAN_URL environment variable and passes that value directly to scan_zip. The local code does not validate the URL scheme, destination hostname, port, or whether TLS is required.

According to the project documentation, scanning transmits the supplied skill ZIP to a remote service. Consequently, control of this environment variable can redirect potentially sensitive source archives away from the documented api.agentverif.com endpoint.

The final behavior of scan_zip resides in the third-party agentverif-sign package and was not included in the audited project. Therefore, this finding concerns the absence of endpoint restrictions before an archive and URL are passed to that dependency.

Attack Path

  1. An attacker compromises a launcher, deployment configuration, shell profile, CI environment, or another component capable of setting environment variables.
  2. The attacker sets AGENTVERIF_SCAN_URL to an endpoint under their control.
  3. A victim invokes sign with a proprietary or sensitive skill ZIP.
  4. cmd_sign reads the attacker-controlled URL without validation.
  5. The skill passes the ZIP path and malicious destination to scan_zip.
  6. If the dependency performs the expected upload, the archive is transmitted to the attacker-controlled endpoint.

Impact Assessment

Exploitation does not inherently elevate local privileges, but it can disclose every file included in the selected ZIP. Depending on archive contents, the exposed scope may include:

  • Proprietary source code and prompts.
  • Embedded credenti ...[truncated 439 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the endpoint override if custom scan services are not a required feature.
  2. Otherwise, parse the URL and require the https scheme.
  3. Enforce an explicit hostname allowlist, such as api.agentverif.com, and reject user-info fields, unexpected ports, redirects to unapproved hosts, and non-public destination changes.
  4. Display the exact upload destination and require explicit confirmation before transmitting an archive.
  5. Document every environment variable that changes network behavior.
  6. Apply equivalent destination validation inside the agentverif-sign package and validate every redirect target.
  7. Provide a local-only scanning option for sensitive archives.
  8. Warn users to exclude credentials and confidential material before upload.
  9. Add tests covering HTTP URLs, malicious hostnames, user-info URL tricks, unexpected ports, and redirect-based allowlist bypasses.

T08 · Insecure Dependencies

Warning
Location
package.json:12
Finding

Security-Sensitive Third-Party Dependency Is Not Pinned to an Exact Version

Content
View full analysis

Vulnerability Details

File Location: package.json:12; related installation guidance at SKILL.md:27-30 and SKILL.md:134-136
Vulnerability Type: Unpinned security-sensitive supply-chain dependency
Risk Level: Medium

json
"python-package": "agentverif-sign>=0.2.0",

Related installation instruction:

text
pip install agentverif-sign

Technical Analysis

The package declaration accepts any agentverif-sign release at or above version 0.2.0, while the documented installation command installs the latest version available from the configured Python package index. No lockfile, exact version, package hash, or other integrity constraint is present in the audited project.

This dependency performs security-sensitive operations on behalf of the skill, including receiving ZIP paths, conducting network requests, modifying archives, verifying signatures, and processing the API key used for revocation. A malicious or compromised future release would therefore execute with the same user privileges as the skill and receive access to sensitive inputs.

This finding does not establish that the current agentverif-sign package is malicious. It identifies an avoidable supply-chain exposure caused by permitting unreviewed future versions.

Attack Path

  1. The dependency publisher account, package repository, release pipeline, or another supply-chain component is compromised.
  2. A malicious version greater than or equal to 0.2.0 is published under the legitimate package name.
  3. A user follows pip install agentverif-sign, or the OpenClaw package resolver installs the newest compatible release.
  4. The malicious package executes during installation or when imported by skill.py.
  5. It can act with the invoking user's privileges and access ZIP files, network traffic, and environment variables supplied to dependency functions.

Impact Assessment

The maximum impact is determined by the priv ...[truncated 517 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin agentverif-sign to a specifically reviewed version rather than using >=0.2.0.
  2. Generate and distribute a lockfile with cryptographic hashes for all transitive dependencies.
  3. Use hash-enforced installation, such as a requirements file compatible with pip --require-hashes.
  4. Verify package provenance and release signatures before updating.
  5. Review each dependency update before changing the pinned version.
  6. Install the package in an isolated virtual environment with minimal filesystem and network permissions.
  7. Avoid exposing AGENTVERIF_API_KEY except for the specific revoke operation.
  8. Consider moving archive parsing and network operations into a sandboxed process with access only to the selected archive.
  9. Add automated dependency vulnerability and provenance checks to the release pipeline.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill's declared metadata and top-level description understate its actual capabilities: it performs network transmission to a third-party API, reads and modifies ZIP files, and uses environment variables for revocation. This mismatch is dangerous because users may invoke the skill expecting passive analysis, while sensitive code archives or secrets could be transmitted or modified under incomplete permission disclosure.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The docstring states the skill writes no local files, but the sign flow calls inject_signature(zip_path, record), which modifies the supplied ZIP on disk. This can mislead users and downstream tooling about side effects, creating integrity and operational risk if callers expect read-only behavior or run it on important artifacts without backups.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The README instructs users to run npx clawhub@latest install agentverif, which fetches and executes the latest published package version at install time rather than a pinned, reviewed version. This creates a supply-chain risk: if the package is compromised, malicious, or unexpectedly changed upstream, users may execute untrusted code during installation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding

The skill advertises commands that use environment variables, shell/Python execution, and likely file/network operations, but it declares no explicit tool scope or permissions. This weakens user and platform visibility into what the skill can access, increasing the risk of unintended command execution, secret exposure, or overbroad runtime privileges.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The installation instruction uses npx clawhub@latest, which is not version-pinned and can pull different code over time. This creates a supply-chain risk: a compromised, malicious, or simply breaking upstream release could change installation behavior without review.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The manifest frames the skill as a scan/sign/verify certification tool for skills, especially around tamper detection and distribution control. In addition to ZIP signing and verification, the code exposes broader text-analysis commands like scan, report, taint-check, and output-check that inspect arbitrary stdin or command-line text rather than just skill packages, which expands behavior beyond the stated product description.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.py (reported line 379)May include surrounding context.

python
print(BILLBOARD)
        sys.exit(2)

    scan_url = os.environ.get("AGENTVERIF_SCAN_URL", "https://api.agentverif.com/scan")
    scan_result = scan_zip(zip_path, scan_url)

    if not scan_result.passed:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

Signing alters the user-provided ZIP in place, but there is no explicit user-facing warning at the point of mutation. In-place modification without clear notice can cause accidental corruption, overwrite trusted artifacts, or break reproducibility and supply-chain workflows that assume inputs remain unchanged.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.