ClawHub Publish Official

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:26 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent ClawHub marketplace helper, but it includes broad unattended skill-update commands and an unpinned global CLI install without enough safety guidance.

Install only if you trust the ClawHub registry and npm package source. Prefer pinning the CLI version, avoid running bulk forced updates unattended, review changelogs before updating installed skills, and check skill directories for secrets before publishing.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:28

Finding

Unpinned Global Installation of a Third-Party npm CLI

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10-15 and 28-31
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

The Skill declares and recommends installation of the clawhub npm package without specifying an exact version or integrity constraint.

yaml

"install":
  [
    {
      "id": "node",
      "kind": "node",
      "package": "clawhub",
      "bins": ["clawhub"],
      "label": "Install ClawHub CLI (npm)",
    },
  ],

bash

npm i -g clawhub

Technical Analysis

Both installation definitions resolve the package by its mutable npm package name rather than by a reviewed, immutable version. The explicit command also installs it globally. Consequently, the code installed at different times can change independently of this Skill's reviewed contents.

npm packages may execute lifecycle scripts during installation. If the package, one of its transitive dependencies, or its publishing account is compromised, following this instruction could execute attacker-controlled code with the permissions of the user running npm. The external package and its dependency graph are not included in this project, so their implementation cannot be verified through this audit.

Global installation also places an executable in a shared command location. This increases the effect of a compromised release because subsequent clawhub commands may invoke attacker-controlled behavior outside the immediate installation step.

Attack Path

1. An attacker compromises the npm package publisher, package distribution process, or a transitive dependency.
2. The attacker publishes a malicious version that remains resolvable under the unpinned clawhub package name.
3. A user follows the Skill instructions and executes npm i -g clawhub, or the framework processes the equivalent metadata installation declaration.
4. npm downloads the malicious release and may ...[truncated 1045 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the CLI to an exact reviewed version in both metadata and documentation, for example clawhub@X.Y.Z.
• Keep the metadata package specification and documented installation command synchronized.
• Record and verify package integrity information where the installation framework supports it.
• Prefer a project-local installation governed by a committed lockfile instead of a global installation.
• Document the authoritative npm package URL, publisher identity, and release-verification process to reduce dependency-confusion and package-spoofing risks.
• Review the selected package version, its transitive dependencies, and npm lifecycle scripts before approval.
• Disable lifecycle scripts during installation when they are not required, or explicitly document and audit any scripts that must run.
• Execute the CLI using a dedicated least-privileged account and avoid elevated installation.
• Regularly reassess pinned versions and apply upgrades only after security review rather than automatically resolving the latest release.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

The documented update functionality allows installed skills to be modified in place, which is a form of self-modification in an agent environment. While updating skills is a legitimate feature, it becomes security-relevant because the source is a remote marketplace and updates can alter future agent behavior, especially when combined with forceful or unattended usage.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

clawhub install my-skill --version 1.2.3

text

## Update Skills

```bash
clawhub update my-skill

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation explicitly includes clawhub update --all --no-input --force, which can modify many installed skills without review or confirmation. In an agent-skill context, bulk non-interactive updates increase the risk of unintentionally pulling changed or malicious dependencies and can cause unattended self-modification of the local skill environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill instructs users to authenticate with clawhub login and publish to a remote marketplace but does not warn about credential handling, disclosure of skill contents, or the trust implications of interacting with a third-party registry. This omission can lead users to publish sensitive content or use credentials without understanding the security and privacy implications.

Content

No source excerpt is available for this finding.