Placeholder Skill

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 5:35 AM UTC
• Version: 0.0.1

Overview

This is a simple placeholder skill that tells users to install a separate main skill, with no executable code or hidden behavior in this artifact.

Installing this placeholder alone should have little effect. Before following its instruction to install `contentclaw`, review that separate skill's publisher, version, permissions, credential use, network endpoints, and whether it can post to Reddit or X on your behalf.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:10

Finding

Unpinned Installation of an Unaudited External Skill

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10–14
Vulnerability Type: Unpinned third-party Skill dependency
Risk Level: Medium

Complete Code Snippet

markdown

This is a reserved name. Install the main skill instead:

clawhub install contentclaw

text

Technical Analysis

The project is a placeholder that directs users to install the external contentclaw Skill by mutable package name. The command does not specify an immutable version, cryptographic digest, verified source repository, or publisher identity.

The downstream Skill is not included in this repository and was therefore outside the audit scope. Its effective instructions and executable components may change independently after this artifact has been reviewed. This creates a supply-chain trust boundary in which users are encouraged to install and trust unreviewed content.

The audited file does not itself retrieve or execute a remote payload, and there is no evidence that the referenced package is malicious. The issue is the unsafe, unpinned dependency installation pattern.

Attack Path

1. An attacker compromises the registry account, publication process, or distribution entry associated with contentclaw, or otherwise causes a malicious release to be served under that mutable name.
2. A user follows the documented clawhub install contentclaw command.
3. The package manager resolves the name to the attacker-controlled or unexpectedly modified release without checking an expected version or digest.
4. The downstream Skill is installed and may execute with whatever tools, credentials, filesystem access, or network permissions the user or Agent grants it.
5. Malicious instructions or code in that package could then act within those granted privileges.

Impact Assessment

Successful exploitation could expose the permissions available to the installed Skill, potentially including Agent tools, local files, network access, and service credentials. The ...[truncated 424 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the downstream Skill to a reviewed, immutable version and cryptographic digest rather than installing solely by package name.
• Publish the canonical source repository, verified publisher identity, release signature, and expected digest.
• Add package-manager integrity and signature verification to the installation procedure.
• Document the downstream Skill's required permissions, external endpoints, credential usage, and data-handling behavior before installation.
• Require explicit user review and confirmation before installing or enabling the external Skill.
• Re-audit each new dependency release before updating the pinned version.
• Apply least privilege by withholding filesystem, network, publishing, and credential access unless each capability is necessary and explicitly authorized.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The description presents the skill as an automated engine that transforms a very broad range of source material into many kinds of outputs, but it does not specify when the skill should activate or what exact trigger phrases or contexts invoke it. This ambiguity can cause unintended matching because the scope is expansive and no negative examples or constraints are provided.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The file advertises publishing to Reddit and X, external search, image generation, and engagement tracking, but presents these capabilities without any user-facing warning that this placeholder itself does not perform them and that the referenced main skill may involve outbound requests and posting actions. Even though this file is non-executable, such messaging can mislead users about potentially sensitive external-service behaviors and reduce informed consent when they proceed to install the main skill.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.