ClawHub Skill Installer

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:21 PM UTC
• Version: 1.0.0

Overview

This skill is a skill installer, but it has serious unsafe installation paths that can overwrite skills, run unpinned external commands, and install unverified GitHub search results.

Review this carefully before installing. It can permanently change your active OpenClaw skills directory, overwrite existing skills, and install code from remote archives that are not cryptographically verified. Avoid using it with untrusted skill names or elevated privileges, and prefer an installer that pins sources, verifies package identity and hashes, validates paths, and asks before overwriting anything.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: install.cjs:110

Finding

Command Injection Through CLI Fallback Commands

Content

View full analysis

&1`, { encoding: 'utf-8', cwd: SKILLS_DIR }); ``` ```javascript execSync(`npx clawhub install ${skillName} --force`, { encoding: 'utf-8', cwd: SKILLS_DIR, stdio: 'inherit' }); ``` ### Technical Analysis The `query` and `skillName` values originate from command-line arguments and are inserted directly into command strings passed to `execSync`. Because `execSync` executes the string through a shell, shell metacharacters contained in either value are interpreted as command syntax rather than literal argument data. The vulnerable commands are reached when the corresponding direct API operation fails. No allowlist validation or shell escaping is applied before execution. ### Attack Path 1. An attacker persuades a user or automation process to invoke `search`, `install`, or `install-batch` with a crafted query or skill name containing shell metacharacters. 2. The attacker causes or waits for the ClawHub API request or installation process to fail. 3. The error handler invokes the ClawHub CLI fallback. 4. The crafted value is interpolated into the shell command. 5. The shell interprets the injected syntax and executes attacker-selected local commands under the installer's user account. ### Impact Assessment Successful exploitation provides arbitrary command execution with all privileges held by the user running the installer. This can allow reading or modifying user-accessible files, stealing credentials, altering OpenClaw configuration, installing malicious skills, or fully compromising the account. If the installer is run with elevated privileges, the impact extends to system-level compromise. ]]>

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: install.cjs:165

Finding

Path Traversal Enables Filesystem Escape and Recursive Deletion

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: install.cjs:127

Finding

Unverified GitHub Search Result Is Installed as a Trusted Skill

Content

View full analysis

0) { const repo = result.items[0]; return { name: skillName, github_url: repo.html_url, download_url: `${repo.html_url}/archive/refs/heads/main.zip` }; } } catch (githubError) { console.error('❌ GitHub 搜索失败:', githubError.message); } ``` ### Technical Analysis When ClawHub metadata retrieval fails, the installer searches GitHub and unconditionally selects the first repository returned. It does not verify the repository owner, repository identity, relationship to the requested ClawHub skill, package manifest, publisher signature, commit hash, or archive digest. The download targets the mutable `main` branch. Its contents can therefore change after review and without a version update. Search-result ranking is not an authenticity mechanism and may be influenced by repository naming, metadata, popularity, or other search factors. The selected archive is subsequently downloaded, extracted, and moved into the active OpenClaw skills directory. ### Attack Path 1. An attacker creates a GitHub repository whose name and metadata match a targeted skill search. 2. The attacker attempts to make that repository rank first for the generated GitHub query. 3. The ClawHub metadata request fails because of service disruption, network conditions, an invalid identifier, or another API error. 4. The installer selects the first GitHub result and downloads its mutable `main` branch. 5. The attacker-controlled archive is installed into the Op ...[truncated 552 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: install.cjs:56

Finding

Unrestricted Redirects and Missing Download Integrity Validation

Content

View full analysis

{ const file = fs.createWriteStream(destPath); const request = https.get(url, (response) => { if (response.statusCode === 302 || response.statusCode === 301) { // 跟随重定向 downloadFile(response.headers.location, destPath).then(resolve).catch(reject); return; } response.pipe(file); file.on('finish', () => { file.close(); resolve(destPath); }); }); request.on('error', (err) => { fs.unlink(destPath, () => {}); reject(err); }); }); } ``` ```javascript const downloadUrl = details.download_url || `${CLAWHUB_API}/api/skills/${skillName}/download`; const zipPath = path.join(TEMP_DIR, `${skillName}.zip`); console.log(`📥 下载: ${downloadUrl}`); await downloadFile(downloadUrl, zipPath); ``` ### Technical Analysis The downloader follows redirects without validating the destination hostname or limiting the redirect count. A trusted initial endpoint can therefore redirect installation to content hosted on an unrelated HTTPS origin. The function also does not require a successful final status, validate the response content type, enforce a maximum archive size, or verify a cryptographic digest or signature. As a result, an error page, oversized response, substituted package, or other untrusted content can be saved and processed as an installation archive. When a redirect occurs, the initially opened output stream is not closed before the recursive download starts, which also creates unsafe file-handling behavior. ### Attack Path 1. ClawHub metadata supplies a malicious or compromised download URL, or a trusted endpoint responds with a redirect. 2 ...[truncated 811 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: install.cjs:14

Finding

Predictable Shared Temporary Paths Permit Symlink and Race Attacks

Content

View full analysis

{ const file = fs.createWriteStream(destPath); ``` The predictable path is later combined with the requested skill name: ```javascript const zipPath = path.join(TEMP_DIR, `${skillName}.zip`); const extractDir = path.join(TEMP_DIR, skillName); ``` ### Technical Analysis The installer uses a fixed directory under the globally shared `/tmp` namespace and predictable filenames derived from skill names. It does not create a private per-process directory, request exclusive file creation, verify ownership, or reject symbolic links. A local attacker may pre-create the directory, archive path, or extraction path. Because `fs.createWriteStream` uses non-exclusive creation by default, a pre-existing symbolic link may redirect writes to another user-accessible file. The separate existence checks and subsequent recursive operations also create time-of-check/time-of-use race windows. ### Attack Path 1. A local attacker predicts the skill name that a victim will install. 2. Before installation, the attacker creates the shared temporary directory or a predictable archive/extraction entry, potentially as a symbolic link. 3. The victim starts the installer. 4. The installer opens, writes, removes, or recreates the attacker-prepared path without exclusive creation or ownership validation. 5. Files accessible to the victim may be overwritten, or installation data may be modified or deleted during the race. ### Impact Assessment Exploitation requires local access to the sam ...[truncated 309 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (22)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 197)May include surrounding context.

md

You can modify these variables at the top of `install.cjs`:

Self-Modification

High

• Category: Rogue Agent
• Confidence: 92% confidence

Finding

Documenting a --force mode that overwrites an existing skill indicates self-modifying behavior that can replace local files with newly downloaded content. In an installer context, this is dangerous because it can destroy prior state or silently replace trusted code with remote content, especially when combined with batch install and rate-limit bypass messaging.

Content

Scanner excerpt · SKILL.md (reported line 226)May include surrounding context.

Force Reinstall

Overwrite existing skill:

bash

node install.cjs install todoist --force

Ssd 2

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README markets the tool as a way to bypass API rate limits by directly downloading zip packages and falling back to alternative installation paths. Framing the tool around circumventing platform controls is a red flag because it encourages behavior outside intended safeguards and may facilitate abuse or installation of unreviewed content.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 135)May include surrounding context.

Linux (Ubuntu/Debian):

bash

sudo apt-get install curl unzip jq

---

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README explicitly describes downloading archives, unzipping them, stripping version names, and moving the contents into the user's skills directory, but provides no warning about installing untrusted code or modifying the filesystem. In the context of a skill installer, this omission is meaningful because users are encouraged to ingest remote packages directly into an execution path.

Content

No source excerpt is available for this finding.

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · README.md (reported line 179)May include surrounding context.

查看已安装的技能

bash

ls -la /Users/xufan65/.openclaw/workspace/skills/

---

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md

- **Bypassing API rate limits** - Intelligently handles ClawHub API restrictions
- **Batch installation** - Install multiple skills in one command
- **Automatic retries** - Smart retry logic when encountering rate limits
- **Version management** - Automatically removes version numbers from skill folder names
- **Comprehensive search** - Find skills directly from ClawHub

## ✨ Features

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation advertises force reinstall and overwrite behavior without a clear warning that installation may modify or replace files in the user's skills directory. This increases the risk of accidental destructive changes, especially because the tool installs downloaded content and supports overwrite semantics.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This code file contains natural-language strings that force a specific language/locale for usage and operational output. Because there is no opt-in, fallback, or indication that the tool is intentionally region-specific, this is a language-policy concern under the natural-language policy rule.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The script invokes npx clawhub search without pinning an exact package version, so execution may fetch and run whatever version is current in the registry at install time. In a security-sensitive installer, this creates a supply-chain execution path outside the audited code and allows compromise if the package is malicious, hijacked, or unexpectedly changed.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest describes a skill installer focused on searching, single/batch installation, retry logic, and version management, but does not indicate subprocess execution as part of its scope. This code invokes external CLI tooling and later also shells out to unzip, introducing command execution capability beyond the clearly stated installer behavior.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · install.cjs (reported line 139)May include surrounding context.

js

// 尝试从 GitHub API 获取（如果技能在 GitHub 上）
    try {
      const githubUrl = `https://api.github.com/search/repositories?q=${encodeURIComponent(skillName)}+clawhub+skill`;
      const data = await httpGet(githubUrl, { 'User-Agent': 'OpenClaw' });
      const result = JSON.parse(data);

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The fallback install path executes npx clawhub install ... --force without version pinning, which can download and run arbitrary updated code from the package registry. Because this path performs installation with force semantics, it amplifies the trust placed in unreviewed remote code and increases supply-chain risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The package description is written only in Chinese ('直接从 ClawHub 下载 zip 包安装技能，绕过 API 速率限制') with no indication that users can choose another language or locale. This creates a natural-language locale constraint in user-facing metadata without documented opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file consistently presents usage instructions, examples, and operational details only in Chinese. Under the policy, forcing a specific language without user opt-in or a documented regional justification is a natural-language policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The examples show user-facing command output entirely in Chinese, and similar Chinese output appears in the install examples, but the document does not state that the tool is Chinese-only or give users a language option. This can violate language or locale policy when a skill implicitly forces a specific language without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The single-install example presents the tool's interactive output in Chinese, reinforcing that the skill may default to a specific language. Without documentation of this constraint or a user-selectable locale, the skill's natural-language behavior may not align with language-choice expectations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The installer silently falls back to GitHub repository discovery and constructs a ZIP download URL from search results, expanding trust from ClawHub to arbitrary GitHub repositories. This broadens the attack surface and can install unverified code from an unintended repository if search results are poisoned, ambiguous, or manipulated.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: install.cjs:114