Security audit

skill-scaffold

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly scaffolds a ClawHub skill as described, but its example workflow can perform a real authenticated publish while presenting the step as a dry run.

Review and edit the workflow before installing or using this skill. Run a real `clawhub publish ... --dry-run` first, inspect the exact files that would be uploaded, scan for secrets, and only then run a separate explicit publish command. Consider pinning the `clawhub` CLI version instead of installing the latest global package.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:26
Finding: Unpinned Global Installation of a Third-Party CLI Package<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 26 **Vulnerability Type**: Unpinned third-party dependency installed globally **Risk Level**: Medium ### Vulnerable Code ```markdown - `clawhub` CLI installed (`npm i -g clawhub`). ``` ### Technical Analysis The documented command installs the latest available version of the `clawhub` npm package globally. It does not pin a reviewed version, verify package integrity, enforce a trusted registry, or otherwise constrain which package artifact npm retrieves. npm package installation can run package lifecycle scripts with the privileges of the invoking user. Consequently, a compromised package release, registry account, or package resolution path could cause attacker-controlled code to execute during installation. Global installation also increases the scope of resulting filesystem changes compared with a project-local dependency. This finding does not establish that the current `clawhub` package is malicious. The vulnerability is the unsafe and non-reproducible dependency installation practice. ### Attack Path 1. An attacker compromises the package publisher, registry account, distribution infrastructure, or a future package release. 2. The attacker publishes a malicious version under the package name used by the documentation. 3. A user follows the prerequisite and runs `npm i -g clawhub` without a version constraint. 4. npm resolves and installs the attacker-controlled release. 5. Malicious lifecycle code executes with the permissions of the user running npm. 6. The compromised package can modify files accessible to that user, steal available credentials, or replace globally installed CLI behavior. ### Impact Assessment Successful exploitation can provide arbitrary code execution with the privileges of the user performing the installation. The attacker could access that user's files and environment variables, steal npm or ClawHub credentials available in the execution context, tampe ...[truncated 273 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the CLI to a specifically reviewed version, for example: ```bash npm install --global clawhub@1.0.0 ``` 2. Prefer a project-local, lockfile-controlled installation instead of a global installation: ```bash npm install --save-dev --save-exact clawhub@1.0.0 npx clawhub@1.0.0 whoami ``` 3. Commit and review the generated lockfile so dependency resolution is reproducible. 4. Configure npm to use an explicitly trusted registry and avoid unreviewed mirrors. 5. Verify package provenance, signatures, or published integrity data where supported. 6. Review package lifecycle scripts and dependency changes before updating the pinned version. 7. Do not recommend running npm installation commands with `sudo` or another elevated account. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:86
Finding: Purported Dry-Run Workflow Executes a Real Publication<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 86-87 **Vulnerability Type**: Unsafe external publication caused by a missing dry-run option **Risk Level**: Medium ### Vulnerable Code ```bash # Dry-run, then publish clawhub publish "./${SLUG}" --slug "${SLUG}" --name "My Utility Skill" --version 1.0.0 --tags utility ``` ### Technical Analysis The documentation states that users should validate with a dry-run before publishing and labels the command block `Dry-run, then publish`. However, the only supplied command omits the documented `--dry-run` option and invokes `clawhub publish` directly. A user relying on the heading may reasonably believe the command performs validation without external side effects. Instead, it can upload the selected directory to ClawHub immediately. Because publication operates on the directory represented by `${SLUG}`, any unintended, unfinished, confidential, or credential-bearing files placed in that directory may be disclosed. The issue is reinforced by the note at line 99 instructing users to use `--dry-run`, while the executable example does not include it. No malicious files or credentials were found in the audited package; the risk arises when users apply this scaffold to their own content. ### Attack Path 1. A user creates a skill directory using the documented scaffold. 2. The user adds working files, references, unpublished material, or sensitive information to the directory. 3. The user follows the section labeled `Dry-run, then publish`. 4. Because the supplied command lacks `--dry-run`, the CLI performs an actual publication rather than a non-publishing validation. 5. Files included by the publishing client are uploaded to the external ClawHub service. 6. Published content may become accessible to the publisher, service operators, or other users according to the service's visibility rules. ### Impact Assessment The primary impact is unintended disclosure and external distribution of files ...[truncated 398 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Provide a genuine dry-run command as the first, separate step: ```bash clawhub publish "./${SLUG}" \ --slug "${SLUG}" \ --name "My Utility Skill" \ --version 1.0.0 \ --tags utility \ --dry-run ``` 2. Clearly separate the real publication command and require an explicit user decision: ```bash # Run only after reviewing the dry-run output and directory contents. clawhub publish "./${SLUG}" \ --slug "${SLUG}" \ --name "My Utility Skill" \ --version 1.0.0 \ --tags utility ``` 3. Instruct users to inspect the exact dry-run file list before publication. 4. Recommend checking for secrets with an appropriate secret scanner and manually reviewing hidden files. 5. Document exclusion or ignore mechanisms supported by the publishing client. 6. Add an explicit confirmation warning that the second command uploads content to an external service. 7. Keep the comments, workflow steps, and executable examples synchronized so a command described as a dry run cannot perform a real publication. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Ae1

High

Category: analysis-evasion
Content: 3. Edit `SKILL.md` body and `skill-card.md` to describe your skill.
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: 3. Edit `SKILL.md` body and `skill-card.md` to describe your skill.
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Static analysis

No suspicious patterns detected.