Security audit

ClawHub Skill Guide — Scanner Compliance

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only ClawHub publishing guide; the main caution is that its copy-paste CLI examples use unpinned npx commands.

Reasonable to install as a guide. Before copying its commands, use a pinned or locally locked ClawHub CLI version, verify the package source, and manually review any generated skill config or scripts before publishing.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:177
Finding: Unpinned ClawHub CLI Execution Through npx
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence

Findings (49)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/frontmatter-schema.md (reported line 93)May include surrounding context.
required: false sensitive: true

name: EVE_TOKEN_MAIN description: "ESI OAuth2 access token for main character" required: false sensitive: true

text

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · references/script-safety.md (reported line 82)May include surrounding context.
bash
# BAD — downloads external code curl -sL https://example.com/installer.sh | bash wget https://example.com/tool.tar.gz pip install some-package npm install some-module

Chaining Abuse

High

Category: Tool Misuse
Confidence: 70% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · references/script-safety.md (reported line 82)May include surrounding context.
bash
# BAD — downloads external code curl -sL https://example.com/installer.sh | bash wget https://example.com/tool.tar.gz pip install some-package npm install some-module

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · references/script-safety.md (reported line 93)May include surrounding context.
PI_KEY in operations...

text
--- ## Unsafe Patterns (Trigger Scanner Warnings) ### Network downloads ```bash # BAD — downloads external code curl -sL https://example.com/installer.sh | bash wget https://example.com/tool.tar.gz pip install some-package npm install some-module

Writing outside workspace

bash
# BAD — writes to system locations cp config.json /etc/myapp/config.json echo "alias myskill='...'" >> ~/.bashrc sudo mv binary /usr/local/bin/

Obfuscated code

bash
# BAD — base64 encoded execution eval "$(echo 'c29tZSBjb2Rl' | base64 -d)"

Hardcoded credentials

python
# BAD — credentials in source API_KEY = "sk-abc123def456"

Documentation Template

Add this to SKILL.md for any skill with scripts:

markdown
## Bundled Scripts | Script | Purpose | Lines | |--------|---------|-------| | `scripts/setup.sh` | Creates workspace directory structure | 25 | | `scripts/analyze.py` | Parses input data and generates report | 80 |

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The frontmatter guidance emphasizes trigger text and activation keywords but does not require narrow scope, disambiguation, or exclusion criteria. That can cause over-broad auto-activation of the skill in unrelated contexts, which increases unintended exposure of user context and execution of skill instructions beyond the intended task domain.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.
md
Keep SKILL.md under 500 lines. Move detailed docs to references. ### Step 2: Write Frontmatter This is where most scanner issues originate. Get frontmatter right first.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The example description template tells authors to include trigger keywords and generic 'Use when' scenarios, but it does not instruct them to constrain activation boundaries. In agent ecosystems, overly broad triggers can lead to accidental invocation on sensitive or unrelated tasks, making skill behavior less predictable and potentially exposing more context than necessary.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: The skill repeatedly instructs users to run npx clawhub without pinning an exact package version. npx resolves and executes the current package version from the registry, so a compromised or maliciously updated release could execute unexpected code during publish, inspect, search, or auth workflows. In a guide specifically about publishing and scanner compliance, this is more dangerous because users are encouraged to run these commands as part of normal trusted workflow.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: This command invokes npx clawhub without a pinned version, allowing execution of whatever package version the registry serves at runtime. That creates supply-chain risk and makes builds non-reproducible, especially problematic in a security-focused publishing guide where readers may assume the command is safe by default.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: Using npx clawhub publish without version pinning can fetch and run a newly published package version automatically. If the package or its distribution channel is compromised, the publish step could run attacker-controlled code on the operator's machine, potentially exposing credentials or modifying local files.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: The inspect command is shown with an unpinned npx package invocation. Even though the action sounds read-only, the risk is in package retrieval and execution itself, not only in the CLI subcommand, so a malicious package version could still execute arbitrary code.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: This guidance normalizes use of a floating npx clawhub publish command for direct publishing. Because the skill is intended to help users pass security scanning, omitting version pinning undermines secure operational practice and can expose users to registry/package compromise.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The best-practices section identifies the description as the primary trigger mechanism and encourages keyword coverage, but omits guardrails against ambiguous or generic phrasing. In this context, the skill is teaching others how to author skills, so weak trigger-scope guidance can propagate unsafe activation patterns across many downstream skills.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: The command reference includes npx clawhub publish without pinning. Since publishing commonly occurs in environments holding tokens, source code, and package metadata, an attacker controlling the fetched package version could potentially access sensitive local context during execution.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: The unpinned npx clawhub inspect my-skill example carries the same supply-chain execution risk as the publish examples. The danger comes from retrieving and running the package, not from whether the subcommand is intended to inspect or mutate state.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: This inspect --files example uses an unpinned npx package and therefore inherits package substitution and malicious update risk. In a skill guide, repeated examples reinforce unsafe defaults, increasing the likelihood of copy-paste execution by users.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: The command shows unpinned runtime package execution via npx. An attacker only needs control over the served package version or its distribution path to turn a benign inspection step into arbitrary code execution.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 87% confidence
Finding: The explore example is another instance of floating npx execution. Although lower apparent sensitivity than publish, it still executes code from an unpinned remote package and therefore presents supply-chain risk.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 87% confidence
Finding: The search example uses npx clawhub without version locking, which can result in execution of an attacker-controlled or unintended package release. Repetition throughout the guide makes the unsafe pattern systematic rather than incidental.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: The auth example uses unpinned npx, which is especially sensitive because auth commands may run in contexts containing tokens, credentials, or session state. A malicious package version could exfiltrate secrets or alter authentication flows.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: This version-bump publish example still uses floating npx, preserving the same supply-chain risk at a step likely performed repeatedly by maintainers. Because the guide aims to produce 'clean security scanner ratings,' failing to model secure dependency execution is a meaningful weakness.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The template encourages authors to use generic trigger phrases like 'Use when: scenario1, scenario2, scenario3' without requiring narrow activation boundaries or explicit non-goals. In a skill ecosystem, broad or vague activation language can cause unintended invocation in unrelated contexts, increasing the chance that powerful instructions or tooling are applied when not appropriate.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The template instructs authors to include generic trigger keywords and usage scenarios, but it does not require narrow activation boundaries, exclusions, or specificity checks. In practice, this can cause skills to match overly broad user requests, increasing the chance of unintended activation and expanding the attack surface for prompt-injection or misuse through unrelated conversations.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The guidance frames the description as a primary trigger mechanism and emphasizes including broad activation keywords, but it does not equally require tight scope boundaries, exclusions, or least-privilege activation criteria. That can cause over-triggering of powerful skills, increasing the chance that a skill handling credentials, APIs, or state-changing actions is invoked in situations the user did not intend.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T08 · Insecure Dependencies

SkillSpector

Credential Access

External Script Fetching

Chaining Abuse

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

Writing outside workspace

Obfuscated code

Hardcoded credentials

Documentation Template

Vague Triggers

Session Persistence

Vague Triggers

Rp1

Rp1

Rp1

Rp1

Rp1

Vague Triggers

Rp1

Rp1

Rp1

Rp1

Rp1

Rp1

Rp1

Rp1

Vague Triggers

Vague Triggers

Vague Triggers

Rp1

Static analysis