Skill Evolver

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:11 PM UTC
• Version: 0.1.0

Overview

The skill is coherent overall, but it can install third-party skills globally before auditing them, so users should review it before use.

Install only if you are comfortable with a skill that searches registries and can install other skills. Before using the registry path, pin CLI/package versions, avoid global or auto-yes installs, inspect downloaded skills in an isolated directory first, and treat generated candidate reports as untrusted data.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

• Location: references/skill-search.md:76
• Finding: Third-Party Skills Are Installed Before Security Review<![CDATA[ ## Vulnerability Details **File Location**: `references/skill-search.md:76-87`, `references/skill-search.md:110-116` **Vulnerability Type**: Unsafe third-party dependency installation **Risk Level**: High ### Vulnerable Code ```bash ## Step 5: Skill Install (Conditional) Only if selected skill is from registry (not local): **Skills.sh:** ```bash npx skills add <slug> -g -y ``` **ClawHub:** ```bash clawhub install <slug> ``` ``` The security audit occurs only after installation: ```bash ## Step 7: Security Audit Run automated security audit on installed skill: ```bash python scripts/audit_skill.py --skill ./skills/<skill-name> --output ${OUTPUT_DIR}/02-audit.md ``` ``` ### Technical Analysis The workflow installs skills obtained from external registries before inspecting their contents. The Skills.sh command is global and non-interactive because it uses `-g -y`. The ClawHub command similarly installs a registry-selected skill before the local audit is performed. A post-installation static scan cannot protect against code executed during package resolution, installation hooks, CLI behavior, or other installer-controlled operations. If a registry package or one of its dependencies is malicious or compromised, code may execute before `audit_skill.py` has an opportunity to reject it. The automated audit is also only a pattern-based scanner. It does not establish package provenance, verify immutable digests, inspect dependency graphs, or prevent installation-time execution. ### Attack Path 1. An attacker publishes a malicious skill or compromises an existing registry skill. 2. The malicious skill is returned by `npx skills find` or `clawhub search`. 3. The user selects the skill through the documented checkpoint. 4. The workflow runs `npx skills add <slug> -g -y` or `clawhub install <slug>`. 5. The registry client, package installer, or installation hooks execute attacker-controlled code with the invoking user's privileges. 6. The security aud ...[truncated 793 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Download candidate skills into a dedicated, isolated temporary directory before installation. 2. Disable package lifecycle scripts and other automatic execution while retrieving candidates. 3. Audit the complete candidate package and its dependency tree before any executable installation step. 4. Pin dependencies to immutable versions and verify publisher identity, checksums, signatures, or content digests. 5. Avoid global and non-interactive installation for untrusted candidates. Install into a project-scoped sandbox only after explicit approval. 6. Run registry clients and validation in a container or restricted process with: - No SSH agent or credential-store access - No cloud credentials - Read-only project access where possible - Restricted outbound network access - A disposable home directory 7. Expand auditing beyond regex matching to include dependency manifests, install hooks, executable files, symbolic links, and provenance metadata. 8. Require a second confirmation after displaying the exact source, version, digest, requested permissions, and audit results. ]]>

T01 · Skill Instruction Hijacking

Warning

• Location: scripts/search_skills.py:51
• Finding: Untrusted Skill Metadata Is Embedded into Agent-Consumed Markdown Without Sanitization<![CDATA[ ## Vulnerability Details **File Location**: `scripts/search_skills.py:51-60`, `scripts/search_skills.py:156-162` **Vulnerability Type**: Prompt or Markdown injection through untrusted skill metadata **Risk Level**: Medium ### Vulnerable Code Candidate-controlled `SKILL.md` content is read and parsed: ```python try: content = skill_md.read_text(encoding="utf-8") frontmatter = parse_frontmatter(content) skills.append({ "name": skill_path.name, "path": str(skill_path), "description": frontmatter.get("description", ""), "source": str(skills_dir) }) except Exception: continue ``` The resulting values are written directly into a Markdown report: ```python for i, skill in enumerate(skills[:10], 1): lines.append(f"### {i}. {skill['name']}") lines.append(f"- **Path**: `{skill['path']}`") lines.append(f"- **Score**: {skill['score']}") lines.append(f"- **Matched**: {', '.join(skill['matched_capabilities']) or 'keyword match'}") lines.append(f"- **Description**: {skill['description'][:200]}..." if len(skill['description']) > 200 else f"- **Description**: {skill['description']}") lines.append("") ``` ### Technical Analysis Skill names, paths, and frontmatter descriptions are treated as trusted presentation content. They are interpolated into `02-candidates.md` without Markdown escaping, normalization, or an explicit untrusted-data boundary. The broader workflow directs an AI Agent to consume the generated candidate report and make skill-selection decisions. A malicious skill can therefore place instruction-like text or Markdown structure in its description. Newlines, headings, links, or imperative instructions can alter the apparent structure of the report and may be interpreted by the Agent as workflow instructions rather than candidate metadata. The 200-character description limit does not prevent injection because short instructions are sufficient. This is a content-channel vul ...[truncated 1343 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Treat all candidate names, paths, descriptions, and registry metadata as untrusted data. 2. Store candidate results in a structured format such as JSON rather than instruction-bearing Markdown. 3. If Markdown is required: - Escape Markdown metacharacters. - Replace or reject embedded newlines and control characters. - Render metadata inside fenced literal blocks. - Prevent candidate data from creating headings, links, HTML, or code fences. 4. Add an explicit instruction to the consuming workflow that candidate metadata is untrusted and that instructions found inside it must never be followed. 5. Validate frontmatter against a strict schema with maximum lengths and permitted character sets. 6. Keep selection decisions based on separately computed fields rather than free-form descriptions. 7. Present the raw metadata to the user for confirmation before acting on it. 8. Add tests containing adversarial descriptions, including fake headings, code fences, links, and instruction-like text. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/audit_skill.py:173
• Finding: Generated Remediation Command Contains an Unquoted Attacker-Influenced Path<![CDATA[ ## Vulnerability Details **File Location**: `scripts/audit_skill.py:173-178` **Vulnerability Type**: Shell command injection in generated remediation guidance **Risk Level**: Medium ### Vulnerable Code ```python lines.extend([ "", "## Action", "```bash", f"rm -rf {skill_path}", "```", "", "Select an alternative skill from candidates.", ]) ``` ### Technical Analysis When a skill is rejected, the audit report includes an executable shell deletion command assembled through direct string interpolation. `skill_path` originates from the `--skill` command-line argument and is not shell-quoted or validated before being inserted into the command. The Python script does not execute this command directly. Exploitation requires a user or Agent to copy or execute the generated remediation command. If the path contains shell metacharacters, command substitution, whitespace, or option-like components, a shell can interpret those characters as syntax rather than as part of a filesystem path. The command also lacks the `--` end-of-options delimiter. In addition to injection concerns, a malformed or ambiguous path could cause deletion outside the intended skill directory. ### Attack Path 1. An attacker causes the audit to be invoked with a crafted skill path, or creates a candidate whose resolved path contains shell-significant characters. 2. The audited skill triggers at least one high-risk pattern and is rejected. 3. `generate_report()` interpolates the crafted path into `rm -rf {skill_path}`. 4. The generated Markdown report presents the resulting string as the recommended remediation command. 5. A user or automation Agent executes the command in a shell. 6. The shell interprets injected metacharacters or substitutions, resulting in unintended command execution or deletion. ### Impact Assessment Successful exploitation can execute commands with the privileges of the user who follows the generated guidance. It can also delete file ...[truncated 347 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not emit copy-pasteable destructive shell commands containing dynamic paths. 2. Provide a non-executable textual instruction that displays the path as data. 3. If deletion is implemented, use a filesystem API such as `shutil.rmtree()` after: - Resolving the path with `Path.resolve()` - Confirming it is a descendant of an approved skills directory - Rejecting the skills root, home directory, filesystem root, and parent traversal - Requiring explicit user confirmation 4. If a shell command must be displayed, quote the path with `shlex.quote()` and include an end-of-options delimiter: ```python import shlex command = f"rm -rf -- {shlex.quote(str(skill_path))}" ``` 5. Display the canonical path and require the user to confirm that exact path before deletion. 6. Add tests for paths containing spaces, leading hyphens, semicolons, command substitutions, quotes, and traversal components. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (30)

Hidden Instructions

High

• Category: Prompt Injection

Content

# skill-evolver

[English](README.md) | [中文](README.zh-CN.md)

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description is about orchestration and lifecycle management of skills: selecting skills, composing/fusing them, and evolving workflows into new skills. The supplied code does none of that. Its primary and sole function is security inspection of a skill's files using predefined regex signatures for dangerous patterns, then producing an audit report and reject/pass result. This is a materially different purpose, with different triggers and resource usage. While both relate to 'skills' at a high level, the actual behavior is security auditing rather than discovery/orchestration/fusion/evolution, so the description does not accurately represent the code.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description promises a broad 'skill lifecycle manager' that can discover, orchestrate, fuse, and evolve skills. The supplied code only implements one small part of that: searching/discovering candidate skills based on capabilities extracted from an intent file. It does not execute skills, plan multi-skill workflows, compose or fuse skills, preserve workflows as new skills, or manage a lifecycle. Its actual permissions/resources are limited to reading local markdown files and writing a markdown report, which is consistent with a search helper but far narrower than the declared purpose. Therefore the description materially overstates the code's primary behavior.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description presents a high-level lifecycle manager for discovering, orchestrating, fusing, and evolving skills. The supplied code does none of those things. It only validates basic installation/structure of a skill directory and emits a report. This is a materially different primary purpose, not merely an implementation detail. There is no logic for deciding which skills to use, combining multiple skills, creating new reusable skills from workflows, or managing lifecycle evolution. The code’s triggers would align with verification or installation checks, which are unrelated to the declared orchestration-focused triggers.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# High risk patterns - auto remove
HIGH_RISK_PATTERNS = [
    (r"rm\s+-rf\s+/", "Destructive: rm -rf /"),
    (r"rm\s+-rf\s+~", "Destructive: rm -rf ~"),
    (r"rm\s+-rf\s+\.\.", "Destructive: rm -rf parent directory"),
    (r"curl\s+[^|]+\|\s*bash", "Remote code execution: curl | bash"),

• Confidence: 100% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# High risk patterns - auto remove
HIGH_RISK_PATTERNS = [
    (r"rm\s+-rf\s+/", "Destructive: rm -rf /"),
    (r"rm\s+-rf\s+~", "Destructive: rm -rf ~"),
    (r"rm\s+-rf\s+\.\.", "Destructive: rm -rf parent directory"),
    (r"curl\s+[^|]+\|\s*bash", "Remote code execution: curl | bash"),

• Confidence: 95% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# High risk patterns - auto remove
HIGH_RISK_PATTERNS = [
    (r"rm\s+-rf\s+/", "Destructive: rm -rf /"),
    (r"rm\s+-rf\s+~", "Destructive: rm -rf ~"),
    (r"rm\s+-rf\s+\.\.", "Destructive: rm -rf parent directory"),
    (r"curl\s+[^|]+\|\s*bash", "Remote code execution: curl | bash"),

• Confidence: 100% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# High risk patterns - auto remove
HIGH_RISK_PATTERNS = [
    (r"rm\s+-rf\s+/", "Destructive: rm -rf /"),
    (r"rm\s+-rf\s+~", "Destructive: rm -rf ~"),
    (r"rm\s+-rf\s+\.\.", "Destructive: rm -rf parent directory"),
    (r"curl\s+[^|]+\|\s*bash", "Remote code execution: curl | bash"),
    (r"wget\s+[^|]+\|\s*bash", "Remote code execution: wget | bash"),

• Confidence: 100% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

External Script Fetching

High

• Category: Supply Chain

Content

(r"rm\s+-rf\s+/", "Destructive: rm -rf /"),
    (r"rm\s+-rf\s+~", "Destructive: rm -rf ~"),
    (r"rm\s+-rf\s+\.\.", "Destructive: rm -rf parent directory"),
    (r"curl\s+[^|]+\|\s*bash", "Remote code execution: curl | bash"),
    (r"wget\s+[^|]+\|\s*bash", "Remote code execution: wget | bash"),
    (r"eval\s+\$\(", "Dynamic code execution: eval $(...)"),
    (r"base64\s+-d.*\|\s*(bash|sh|python)", "Obfuscated execution: base64 decode | bash"),

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Script Fetching

High

• Category: Supply Chain

Content

(r"rm\s+-rf\s+~", "Destructive: rm -rf ~"),
    (r"rm\s+-rf\s+\.\.", "Destructive: rm -rf parent directory"),
    (r"curl\s+[^|]+\|\s*bash", "Remote code execution: curl | bash"),
    (r"wget\s+[^|]+\|\s*bash", "Remote code execution: wget | bash"),
    (r"eval\s+\$\(", "Dynamic code execution: eval $(...)"),
    (r"base64\s+-d.*\|\s*(bash|sh|python)", "Obfuscated execution: base64 decode | bash"),
    (r">\s*/dev/sd[a-z]", "Disk destruction: write to disk device"),

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

(r"mkfs\.\w+\s+/dev/", "Disk format: mkfs on device"),
    (r"dd\s+if=.*of=/dev/", "Disk destruction: dd to device"),
    (r":()\s*{\s*:\|:&\s*}", "Fork bomb"),
    (r"chmod\s+-R\s+777\s+/", "Unsafe permission: chmod 777 /"),
    (r"chown\s+.*\s+/", "System ownership change"),
    (r">\s*/etc/passwd", "System file modification: passwd"),
    (r">\s*/etc/shadow", "System file modification: shadow"),

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Credential Access

High

• Category: Privilege Escalation

Content

(r":()\s*{\s*:\|:&\s*}", "Fork bomb"),
    (r"chmod\s+-R\s+777\s+/", "Unsafe permission: chmod 777 /"),
    (r"chown\s+.*\s+/", "System ownership change"),
    (r">\s*/etc/passwd", "System file modification: passwd"),
    (r">\s*/etc/shadow", "System file modification: shadow"),
    (r">\s*/etc/sudoers", "Privilege escalation: sudoers"),
    (r"curl\s+.*\.(pem|key|p12|pfx)", "Credential exfiltration: upload keys"),

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

(r"chmod\s+-R\s+777\s+/", "Unsafe permission: chmod 777 /"),
    (r"chown\s+.*\s+/", "System ownership change"),
    (r">\s*/etc/passwd", "System file modification: passwd"),
    (r">\s*/etc/shadow", "System file modification: shadow"),
    (r">\s*/etc/sudoers", "Privilege escalation: sudoers"),
    (r"curl\s+.*\.(pem|key|p12|pfx)", "Credential exfiltration: upload keys"),
    (r"cat\s+.*\.(pem|key|id_rsa)", "Credential access: read private keys"),

• Confidence: 95% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

(r">\s*/etc/shadow", "System file modification: shadow"),
    (r">\s*/etc/sudoers", "Privilege escalation: sudoers"),
    (r"curl\s+.*\.(pem|key|p12|pfx)", "Credential exfiltration: upload keys"),
    (r"cat\s+.*\.(pem|key|id_rsa)", "Credential access: read private keys"),
    (r"aws\s+.*\bsend\b", "Potential AWS data exfiltration"),
    (r"export\s+.*=.*\$\(", "Dynamic env variable with subshell"),
]

• Confidence: 80% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence
• Finding: The README recommends executing `npx skills add ClawSkill/skill-evolver -g -y` without pinning a package version. `npx` resolves and executes the latest published package at runtime, so a compromised upstream package, typosquat, or malicious update could lead users to run unreviewed code on their machine during installation.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: The usage example `npx skills find <query>` invokes a remote package without a pinned version, which means behavior can change or become malicious between runs. In a security-sensitive skill whose purpose includes discovering and evaluating third-party skills, this increases risk because users are encouraged to trust a toolchain step that itself is not fixed or reproducible.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: The example `npx skills add <source> -g -y` combines unpinned remote execution with automatic installation flags, reducing user review and making a supply-chain compromise more dangerous. Because this skill manages lifecycle decisions for other skills, instructing users to auto-install via floating tooling materially expands the attack surface for malicious package or dependency substitution.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The README instructs users to run `npx skills add ...` without pinning an exact package version. `npx` resolves and executes code from the registry at install/runtime, so a compromised upstream package, typosquat, or unexpected latest-version change could lead to unreviewed code execution on the user's machine. In the context of a skill lifecycle manager that explicitly discovers and installs remote skills, this is more dangerous because users are being encouraged to trust and fetch tooling dynamically.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence
• Finding: This usage example tells users to invoke `npx skills find <query>` without version pinning, which can execute whatever version is currently served by the package registry. If the package is compromised or updated maliciously, searching for skills could become an initial execution vector before any later audit step occurs. Because this project is about discovering and evaluating third-party skills, dynamic unpinned tool execution weakens the very trust boundary the skill claims to enforce.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence
• Finding: The README recommends `npx skills add <source> -g -y` without pinning the package version, which may result in arbitrary code execution from an untrusted or changed registry package during installation. This is particularly risky here because the command both fetches remote tooling and installs additional remote skill content, compounding supply-chain exposure.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill instructs the agent to read and write files and execute shell commands, but it declares no explicit tool scope or permissions. That creates an authorization ambiguity where a host may permit broader capabilities than intended, increasing the chance of unsafe filesystem or command execution during skill use.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence
• Finding: Using `npx skills` without pinning a package version allows execution of whatever package version is current in the registry at runtime. If the package is compromised, typo-squatted, or updated maliciously, the workflow may run attacker-controlled code during a security-sensitive skill discovery/install process.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence
• Finding: The instruction to use `npx skills <command>` fetches and executes an unpinned remote package, which creates a supply-chain risk. In this context, the command is part of a workflow for selecting and installing more code, so compromise here can taint the entire downstream process.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: `npx skills find <capability>` relies on an unpinned package name resolved from the registry at execution time. Because this step directly influences which external skills are later installed, a compromised package could manipulate search results or execute arbitrary code before the later audit step occurs.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The workflow instructs global installation commands (`npm i -g`, `pnpm add -g`, and `npx ... -g -y`) without an explicit warning that they modify the user's environment. That can lead users to make persistent system-wide changes or run postinstall scripts from untrusted packages, which is especially risky here because the workflow is designed to fetch third-party skills from registries.

Static analysis

No suspicious patterns detected.