Clawhub Publisher

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:44 PM UTC
• Version: 1.0.0

Overview

This skill is a coherent publishing tool, but it asks users to run unaudited external packages with publishing credentials and account-changing authority without enough scoping or safety guidance.

Review this carefully before installing. Use an isolated environment, pin and verify the publisher package, avoid global install where possible, pass credentials through protected environment or secret-manager mechanisms instead of command-line flags, use least-privilege short-lived tokens, run dry-run or validation first, and inspect the skill directory for secrets before publishing or rollback.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: README.md:23

Finding

Unpinned External Packages Are Installed and Executed Without Auditable Local Source

Content

View full analysis

Vulnerability Details

File Location: README.md:23-28, README.md:64-78, README.md:193-199, SKILL.md:49-54
Vulnerability Type: Supply-chain exposure through unpinned external dependencies
Risk Level: High

Vulnerable Code Snippets

README.md:23-28:

bash

npm install clawhub-publisher
# or
python -m pip install clawhub-publisher

README.md:64-78:

bash

npm install clawhub-publisher

bash

pip install clawhub-publisher

bash

npm install -g clawhub-publisher
clawhub-publisher --version
clawhub-publisher login --token YOUR_API_KEY

README.md:193-199:

yaml

- uses: actions/checkout@v3
- uses: actions/setup-node@v3
- run: npm install clawhub-publisher
- run: npx clawhub-publisher publish \
    --api-key ${{ secrets.CLAWHUB_API_KEY }} \
    --skill-path ./my-skill \
    --version ${GITHUB_REF#refs/tags/v}

SKILL.md:49-54:

bash

npm install clawhub-publisher
# or
pip install clawhub-publisher

Technical Analysis

The documentation directs users and CI systems to retrieve and execute clawhub-publisher from external npm and Python registries without an exact version, package integrity hash, lockfile, or locally included implementation.

The supplied package.json declares index.js as the main module and bin/cli.js as the command-line entry point, but neither file exists in the audited artifact. As a result, the code that would receive publishing credentials, inspect local skill files, bundle assets, and communicate with external services cannot be reviewed.

Unpinned package resolution allows the effective code to change after this artifact has been audited. If the registry package, publisher account, release process, or dependency tree is compromised, malicious installation or runtime code could execute with the privileges of the user or CI runner. Global installation further increases exposure by making ...[truncated 1425 chars]

Remediation

View remediation

Remediation Suggestions

1. Include the complete implementation, including index.js and bin/cli.js, in the reviewable project.
2. Pin dependencies and installation examples to exact, verified versions rather than mutable latest releases.
3. Publish and verify package integrity hashes or signed provenance attestations.
4. Commit and enforce an appropriate lockfile for the supported package ecosystem.
5. Select one verified distribution channel unless both npm and Python packages are independently maintained and auditable.
6. Avoid global installation; prefer project-local execution in a restricted environment.
7. Disable or review package lifecycle scripts where feasible.
8. Run publishing jobs with minimal filesystem, network, repository, and deployment permissions.
9. Verify registry namespace ownership and release provenance before installation.
10. Pin third-party CI actions to immutable commit hashes rather than mutable major-version tags.

T09 · Insecure Skill Coding Practices

Warning

• Location: README.md:193

Finding

ClawHub API Tokens Are Passed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: README.md:76-78, README.md:193-199, README.md:250-253
Vulnerability Type: Sensitive credential exposure through process arguments and CI logging
Risk Level: Medium

Vulnerable Code Snippets

README.md:76-78:

bash

npm install -g clawhub-publisher
clawhub-publisher --version
clawhub-publisher login --token YOUR_API_KEY

README.md:193-199:

yaml

- uses: actions/checkout@v3
- uses: actions/setup-node@v3
- run: npm install clawhub-publisher
- run: npx clawhub-publisher publish \
    --api-key ${{ secrets.CLAWHUB_API_KEY }} \
    --skill-path ./my-skill \
    --version ${GITHUB_REF#refs/tags/v}

README.md:250-253:

bash

# Login to ClawHub
clawhub-publisher login --token YOUR_API_KEY

Technical Analysis

The documented commands place authentication secrets in command-line arguments through --token and --api-key. Command-line arguments may be visible to process-inspection tools, system monitoring agents, crash diagnostics, shell tracing, CI troubleshooting output, or audit collectors, depending on operating-system and runner configuration.

Although GitHub Actions commonly masks registered secrets in ordinary logs, masking is not a complete substitute for avoiding secret-bearing arguments. The expanded value still reaches the process argument vector, and masking can fail when values are transformed, copied into diagnostics, or handled by untrusted tooling.

Attack Path

1. A user runs the documented login command or a CI job expands CLAWHUB_API_KEY into the CLI argument vector.
2. The secret becomes part of the running process's command-line arguments.
3. A local process with sufficient inspection access, a monitoring component, diagnostic collector, or improperly configured CI logger captures the arguments.
4. An attacker obtains the captured token from process data, logs, or diagnostics.
5. The atta ...[truncated 705 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove --token and --api-key options from recommended workflows.
2. Read credentials from a dedicated protected environment variable without copying them into command-line arguments.
3. Where practical, support credential delivery through standard input or an operating-system secret store.
4. Ensure the CLI never logs credential values, request authorization headers, or complete process arguments.
5. Disable shell tracing around authentication and publishing commands.
6. Use short-lived, narrowly scoped publishing tokens with rotation and revocation support.
7. Restrict CI secrets to protected branches, trusted environments, and jobs that require publishing access.
8. Apply CI secret masking as defense in depth, not as the primary protection.
9. Document immediate token revocation and audit-log review procedures for suspected disclosure.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README explicitly advertises automatic README modification via Gumroad link injection but does not warn that publishing may alter files in the user's skill directory. Silent or unexpected file mutation is dangerous because it can change tracked content, inject marketing material into repositories, and cause unintended commits or downstream publication of modified artifacts.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The documented rollback command performs a potentially destructive state change but provides no warning, confirmation, or discussion of consequences. In a publishing system, rollback can unpublish or replace a live version, disrupt users, and accidentally revert to an older insecure or incompatible release.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill presents automated publishing to an external service as a convenience feature but does not clearly warn that project files, bundled assets, metadata, and possibly repository-derived content will be transmitted to ClawHub. This can lead users to publish sensitive or unintended data without informed consent, especially in CI/CD or team workflows where automation increases the chance of broad, repeated disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The quick-start example instructs users to provide an API key and immediately perform a publish action, but it does not warn that this grants the tool authority to act on the user's external ClawHub account. Without guidance on credential scope, secure storage, and the consequences of invoking publish, users may mishandle secrets or trigger unauthorized/irreversible account actions from local or CI environments.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.