ClawHub Publish Mother Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:31 AM UTC
• Version: 1.2.0

Overview

This publishing helper is mostly aligned with ClawHub publishing, but it exposes authentication tokens in troubleshooting output and promotes stealth/proxy login behavior.

Review carefully before installing. Do not run the troubleshooting script with a real CLAWHUB_TOKEN unless it is fixed to mask the value. Prefer documented token authentication over stealth browser or residential proxy login flows, and publish only from a clean directory after reviewing every file that will be uploaded.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/troubleshoot-auth.sh:14

Finding

Authentication Token Exposed in Troubleshooting Output

Content

View full analysis

Vulnerability Details

File Location: scripts/troubleshoot-auth.sh, lines 14-18
Vulnerability Type: Plaintext sensitive-data exposure
Risk Level: High

Vulnerable Code

bash

# Check environment
echo ""
echo "3. Environment Check:"
echo "  CLAWHUB_TOKEN: ${CLAWHUB_TOKEN:-Not set}"
echo "  BROWSERBASE_CAMO_FOX: ${BROWSERBASE_CAMO_FOX:-Not set}"

Technical Analysis

The troubleshooting script expands and prints the complete value of CLAWHUB_TOKEN. This token is an authentication credential used for ClawHub operations and should be treated as a secret.

Printing the value is unnecessary for determining whether the variable is configured. The output may be retained in CI logs, terminal recordings, agent tool transcripts, support bundles, or copied troubleshooting reports. Because the shell performs parameter expansion before echo runs, the credential appears directly in plaintext.

Attack Path

1. A user exports a valid ClawHub token through CLAWHUB_TOKEN.
2. The user or an automated agent runs scripts/troubleshoot-auth.sh.
3. The script writes the complete token to standard output.
4. A CI system, terminal recorder, agent transcript, or support process stores that output.
5. An unauthorized party obtains the logged token.
6. The party reuses it against ClawHub for any operation authorized by the token.

Impact Assessment

An attacker who obtains the token may impersonate its owner within the token's granted scope. Depending on ClawHub's authorization model, this could permit unauthorized publication or modification of skills and access to associated account functions.

This issue does not grant local privilege escalation by itself. Its scope is limited to the permissions assigned to the exposed ClawHub credential, but those permissions may include supply-chain-sensitive publishing capabilities.

Remediation

View remediation

Remediation Suggestions

• Never print the complete value of CLAWHUB_TOKEN.
• Report only whether the variable is set:

  bash

  if [ -n "${CLAWHUB_TOKEN:-}" ]; then
      echo "  CLAWHUB_TOKEN: set"
  else
      echo "  CLAWHUB_TOKEN: not set"
  fi
  

• If identification is essential, display only a short masked suffix and avoid exposing enough characters to facilitate recovery.
• Configure CI systems to redact ClawHub token patterns as an additional defense.
• Document that troubleshooting output must not contain credentials.
• Revoke and rotate any token that has already appeared in logs or transcripts.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:38

Finding

Incomplete Secret Scan Before Whole-Directory Publication

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 38-59
Vulnerability Type: Insufficient sensitive-file validation before external publication
Risk Level: Medium

Vulnerable Code

bash

### 2. Skill Preparation
```bash
cd /path/to/your-skill

# Validate skill structure
./scripts/validate.sh

# Check for personal information
grep -i "C:\\\\\|/home/\|password\|token\|secret" SKILL.md || echo "Clean"

3. Publishing

bash

# Dry run first
clawhub publish . --dry-run

# Actual publish
clawhub publish . \
  --slug "your-unique-slug" \
  --name "Skill Display Name" \
  --version "1.0.0" \
  --changelog "Initial release"

Technical Analysis

The documented safety check examines only SKILL.md, while the subsequent command publishes the entire current directory through clawhub publish .. Sensitive content may exist in scripts, references, nested directories, dotfiles, environment files, configuration files, backups, or unrelated artifacts and remain completely outside the scan.

The scan is also a keyword search rather than a credential detector. Secrets that do not contain the literal words password, token, or secret will not be identified. Conversely, benign documentation containing those words will produce matches without determining whether an actual credential exists.

The message Clean therefore creates an unreliable assurance immediately before a network publication operation.

Attack Path

1. A user stores a credential, private configuration, personal data, or unrelated proprietary file somewhere in the skill directory other than SKILL.md.
2. The documented grep command scans only SKILL.md and prints Clean if no listed keyword is found there.
3. The user interprets that result as confirmation that the project is safe to publish.
4. clawhub publish . submits the broader directory contents to ClawHub.
5. The sensitive file becomes acc ...[truncated 591 chars]

Remediation

View remediation

Remediation Suggestions

• Publish from a clean staging directory containing only an explicit allowlist of required files.
• Document the exact files included by clawhub publish and require review of the dry-run manifest.
• Recursively scan all files intended for publication with a dedicated secret scanner rather than relying only on keyword matching.
• Exclude environment files, VCS metadata, editor backups, local configuration, credentials, build artifacts, and unrelated nested content.
• Fail closed when scanning cannot be completed; do not print Clean based only on one file.
• Add an explicit confirmation step showing the complete publication manifest before uploading.
• Rotate any credential discovered in content that has already been published.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Unpinned Global Installation of a Third-Party CLI

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 15
Vulnerability Type: Unpinned third-party dependency and unsafe global installation
Risk Level: Medium

Vulnerable Code

bash

npm install -g clawhub

Technical Analysis

The prerequisite installs the latest package published under the clawhub npm package name without pinning a reviewed version or verifying package provenance or integrity.

As a result, the code installed when a user follows the instructions may differ from the code available when this Skill was audited. npm packages may execute lifecycle scripts during installation, and the globally installed CLI later runs with the invoking user's permissions. A compromised maintainer account, malicious release, package-name confusion, or upstream supply-chain compromise could therefore introduce arbitrary behavior.

Global installation also expands the effect beyond the project environment and makes dependency state less reproducible.

Attack Path

1. The npm package or a future package release is compromised, or the user resolves an unintended package with the same expected name.
2. A user follows the documented npm install -g clawhub command.
3. npm downloads and installs the currently published package without a reviewed version or integrity constraint.
4. Malicious lifecycle code may execute during installation, or malicious CLI code may run during subsequent authentication and publishing commands.
5. The malicious package accesses data available to the invoking user, potentially including ClawHub credentials and project contents.

Impact Assessment

Successful supply-chain exploitation could execute arbitrary code with the permissions of the user running npm or the installed CLI. This may expose local files, publishing credentials, source code, and account access available in the execution environment.

The project does not itself demonstrate that the clawhub package is m ...[truncated 186 chars]

Remediation

View remediation

Remediation Suggestions

• Pin an explicitly reviewed package version, for example:

  bash

  npm install -g clawhub@REVIEWED_VERSION
  

• Verify the official package identity, publisher, repository, signatures, and provenance before recommending installation.
• Prefer a project-local dependency with a lockfile and integrity metadata over a global installation.
• Disable lifecycle scripts when they are not required and compatible with the package:

  bash

  npm install --ignore-scripts
  

• Run the CLI in a constrained environment with only the files and credentials necessary for publication.
• Establish an update process that reviews new package versions before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The workflow states that login will work with 'bot detection evasion,' directly encouraging bypass of anti-abuse controls during OAuth authentication. This is dangerous because it promotes circumvention of service protections in a sensitive auth flow, potentially enabling unauthorized automation, account lockouts, terms-of-service violations, and reputational or legal exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script prints the full value of the CLAWHUB_TOKEN environment variable directly to stdout, which can expose a live authentication secret in terminal history, CI logs, screen recordings, shared troubleshooting output, or support tickets. In a troubleshooting context this is especially risky because users are likely to copy and share the output with others, turning accidental disclosure into credential compromise.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill provides a complete token-authenticated publishing workflow to an external service but does not clearly warn that clawhub publish may upload the skill contents, metadata, and potentially embedded sensitive information. This is risky because users may authenticate and publish without understanding the data egress implications, especially since the document emphasizes that authentication is 'verified' and operational rather than safe handling and disclosure boundaries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The document explicitly instructs users to enable stealth browsing and residential proxying for authentication, but omits any warning that this changes network attribution and may violate platform, organizational, or account-security expectations. In a publishing/authentication workflow, normalizing proxy-based stealth increases the chance of policy evasion, user deception, and risky credential handling under obscured infrastructure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

SQP-3 applies to natural-language policy issues in all file types, including markdown. The file explicitly prescribes 'British Phrases' and ends with 'British dry humour + canine personas' without indicating that this locale/style is optional, which can conflict with a language or locale choice policy.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.