Skill Dual Publish

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:59 AM UTC
• Version: 1.0.1

Overview

This skill has a legitimate publishing purpose, but it instructs agents to automatically run a powerful external publishing script that can push content publicly and edit local configuration without fresh user confirmation.

Install only if you intentionally want an agent to publish skills to GitHub and ClawHub. Before using it, verify the external script contents and checksum, resolve the skill-publish versus skill-dual-publish identity mismatch, run a dry run, confirm repository owner, visibility, slug, version, file set, and approve any AGENTS.md or SKILL.md edits separately.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:22

Finding

Mandatory Autonomous Publication Without Renewed User Consent

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 22-34 and 76-82
Vulnerability Type: Forced agent behavior with external side effects
Risk Level: High

Vulnerable Code Snippet:

markdown

## 何时执行（强制）

在以下任一场景**完成后立即运行**（不要等用户提醒）：

1. 新建 `workspace/skills/<name>/SKILL.md` 并通过用户认可
2. 对已有 skill 做值得发布的版本更新
3. `skillify` 脚手架完成、stub 替换为真实内容后

## 一键命令

```bash
bash ~/.openclaw/workspace/scripts/skill-publish-dual.sh <skill-name>

text

```markdown
## 脚本自动完成

1. 补齐 `LICENSE` / `README.md`（若缺失）
2. `git init` → `gh repo create` → `git push`（若无远程）
3. 更新 `SKILL.md` 的 `homepage:` 为 GitHub URL
4. `clawhub publish <绝对路径> --slug ... --version ...`
5. 在 `AGENTS.md` skillpack 表追加一行（若尚无）

Technical Analysis

The skill explicitly directs the agent to execute a publishing workflow immediately and not wait for the user to request it. This instruction alters the agent's normal decision-making by treating prior acceptance of skill content as authorization for later repository creation, network publication, metadata changes, and persistent edits to AGENTS.md.

Approval of content does not necessarily constitute approval to make that content public. The instructed operation crosses a significant trust boundary because it uses authenticated GitHub and ClawHub sessions and produces externally visible side effects. The package provides a dry-run option, but it does not require the agent to use it or obtain confirmation after reviewing the exact publication plan.

Attack Path

1. The skill is loaded into an agent session.
2. The user asks the agent to create or materially update another skill.
3. The agent follows the mandatory instruction to publish immediately without asking again.
4. The external script initializes a repository, creates a GitHub repository, and pushes local files.
5. The script publishes the skill to ClawHub using the user's authenticated account.

...[truncated 765 chars]

Remediation

View remediation

Remediation Suggestions

• Remove language that mandates immediate execution or instructs the agent not to wait for the user.
• Require explicit, task-specific confirmation immediately before every network publication.
• Before requesting approval, show the exact local directory, files to be uploaded, repository owner and name, repository visibility, ClawHub slug, version, and proposed local modifications.
• Run the workflow in --dry-run mode first and present its output to the user.
• Separate content approval from publication approval.
• Default newly created repositories to private unless the user explicitly requests public visibility.
• Scan the proposed publication set for credentials, tokens, private keys, personal information, and unrelated workspace files.
• Require separate consent before changing persistent files such as AGENTS.md.

T07 · Tool Hijacking and Spoofing

Error

• Location: SKILL.md:30

Finding

Execution of an Unbundled and Unverified External Script

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 30-44
Vulnerability Type: Trusting a mutable local tool outside the audited package
Risk Level: High

Vulnerable Code Snippet:

markdown

## 一键命令

```bash
bash ~/.openclaw/workspace/scripts/skill-publish-dual.sh <skill-name>

示例：

bash

bash ~/.openclaw/workspace/scripts/skill-publish-dual.sh human-distill
bash ~/.openclaw/workspace/scripts/skill-publish-dual.sh my-skill --bump patch -c "Fix triggers"
bash ~/.openclaw/workspace/scripts/skill-publish-dual.sh my-skill --slug my-unique-slug   # ClawHub 重名时

text

### Technical Analysis

The skill directly invokes a shell script located at `~/.openclaw/workspace/scripts/skill-publish-dual.sh`. That script is not included in the audited project, which contains only `SKILL.md` and `README.md`. Consequently, none of the script's implementation, argument handling, file-selection logic, network operations, or integrity controls can be verified from this package.

Invoking the file explicitly through `bash` causes its contents to execute regardless of whether it has an executable bit. The path is under a user workspace and may be mutable by the user, another local process, an extension, or another skill with workspace write access. The documentation does not require validation of ownership, permissions, checksum, version, or contents before execution.

This creates a tool-hijacking boundary: a legitimate-looking publishing command can execute behavior different from the reviewed documentation if the referenced file is replaced or modified.

### Attack Path

1. An attacker or compromised local component obtains write access to `~/.openclaw/workspace/scripts/skill-publish-dual.sh`.
2. The attacker replaces or modifies the script to include arbitrary shell commands.
3. The agent loads this skill and reaches one of its mandatory publication triggers.
4. The agent runs the documented `bash
...[truncated 911 chars]

Remediation

View remediation

Remediation Suggestions

• Include the publishing implementation within the reviewed package rather than referencing an unrelated mutable workspace path.
• Pin the implementation to a specific reviewed release or immutable commit.
• Verify a cryptographic checksum or signature before every execution.
• Validate that the file has the expected owner and is not writable by untrusted users or groups.
• Display the resolved path, implementation version, and checksum before requesting user approval.
• Avoid sourcing shell configuration or executing dynamically discovered commands.
• Apply strict shell practices, including safe argument parsing, quoted variables, fixed command paths where appropriate, and rejection of unexpected input.
• Run publication with the least privileges possible and do not expose unrelated credentials to the process.
• Require explicit user confirmation even after integrity verification succeeds.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:2

Finding

Conflicting Package, Repository, and ClawHub Identities

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 2-5; README.md, lines 12-16
Vulnerability Type: Ambiguous dependency and installation identity
Risk Level: Medium

Vulnerable Code Snippet:

yaml

name: skill-publish
version: 1.0.0
homepage: https://github.com/spikesubingrui-design/skill-dual-publish
clawhub_slug: skill-dual-publish

markdown

```bash
clawhub install skill-publish

bash

git clone https://github.com/spikesubingrui-design/skill-publish.git ~/.openclaw/workspace/skills/skill-publish

text

### Technical Analysis

The skill metadata declares the name `skill-publish` but identifies its homepage and ClawHub slug as `skill-dual-publish`. The README instead directs users to install the ClawHub artifact `skill-publish` and clone the GitHub repository `spikesubingrui-design/skill-publish`.

These are distinct identifiers and repository URLs. The supplied project does not establish that all of them resolve to the same source, owner-controlled release, or commit. This inconsistency prevents users from reliably determining whether the installed artifact is the artifact represented by the audited metadata.

Ambiguous package identity is a supply-chain weakness because users may retrieve a differently named component while believing they are installing the reviewed skill. No immutable version, commit hash, signature, or checksum is supplied to resolve the ambiguity.

### Attack Path

1. A user reviews or trusts the metadata associated with `skill-dual-publish`.
2. The user follows the README and installs `skill-publish` from ClawHub or clones the differently named GitHub repository.
3. The installation source resolves to content that is not identical to the reviewed artifact.
4. The user loads or executes the unintended package under the assumption that it is the audited skill.
5. Any behavior in that other artifact runs with the trust granted to the expected pac
...[truncated 747 chars]

Remediation

View remediation

Remediation Suggestions

• Select one canonical package name, ClawHub slug, and GitHub repository name.
• Update name, homepage, clawhub_slug, badges, installation commands, and clone URLs so they consistently reference that identity.
• Verify ownership of every referenced namespace before publishing corrected documentation.
• Pin installation instructions to an immutable release, tag backed by a verified commit, or explicit commit hash.
• Publish checksums or signed release attestations and document how users should verify them.
• Add automated release checks that reject metadata and documentation when repository URLs, package names, or slugs do not match.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

md

ClawHub slug 默认等于 `SKILL.md` 的 `name`；若被占用，在 frontmatter 加 `clawhub_slug:` 或传 `--slug`。

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md

ClawHub slug 默认等于 `SKILL.md` 的 `name`；若被占用，在 frontmatter 加 `clawhub_slug:` 或传 `--slug`。

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

md

ClawHub slug 默认等于 `SKILL.md` 的 `name`；若被占用，在 frontmatter 加 `clawhub_slug:` 或传 `--slug`。

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill advertises multiple trigger phrases, including broad natural-language variants such as '发布 skill' and 'skill publish', and the document further says it must run automatically after certain events. That creates a meaningful risk of unintended invocation of a high-impact publishing workflow that can create repositories, push code, and publish externally without an explicit, fresh user confirmation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description and instructions emphasize mandatory automatic execution, but do not prominently warn that the workflow may initialize git, create a GitHub repository, push content, modify SKILL.md homepage metadata, generate files, and publish to ClawHub. Because these actions affect external services and mutate local project state, insufficient disclosure increases the chance of users triggering irreversible or privacy-impacting publication unintentionally.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.