ClawHub
Back to skill

Security audit

TaskFlow-ClawHub Publish 编排技能

Security checks for vulnerabilities and agentic risk

Overview

This skill transparently helps publish an OpenClaw skill to ClawHub, with its irreversible registry write disclosed and aligned with its stated purpose.

Install only if you want an agent to run a structured ClawHub publishing workflow. Before use, manually confirm the target skill folder, slug, version, name, and changelog because the real publish step writes to the registry and is described as irreversible.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill explicitly defines a publish step as an externally irreversible action, but it does not require an explicit user confirmation gate immediately before execution. In an agentic context, this increases the risk of accidental or premature publication of unreviewed, sensitive, or malicious content because the workflow can proceed from dry-run validation straight into a real registry write.

Static analysis

No suspicious patterns detected.