ClawHub
Back to skill

Security audit

skill-hr

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a legitimate skill manager, but it needs review because it can influence skill installation/delegation and its optional benchmark scripts can send API keys and benchmark content to configurable external endpoints.

Install only if you want a skill-management layer that can inspect installed skill metadata, recommend or stage skill installs, and maintain project-local HR-style logs. Before using recruitment or benchmark features, review every install command, avoid broad updates unless intended, do not put secrets in incidents or benchmark cases, and run API scripts only with trusted HTTPS endpoints and appropriate API keys.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Warning
Location
scripts/run_matching_benchmark_llm.py:247
Finding

Untrusted Skill Metadata Is Embedded in LLM Prompts Without Prompt-Injection Isolation

Content
View full analysis
dict[str, Any]: jd = case.get("gold_jd") if not isinstance(jd, dict): raise ValueError("case missing gold_jd object") catalog = case.get("skill_catalog") if not isinstance(catalog, list): raise ValueError("case missing skill_catalog array") matching = case.get("matching") if not isinstance(matching, dict): matching = {} delegate_min = matching.get("delegate_min_score", 75) confirm_min = matching.get("confirm_band_min", 60) return { "case_id": case.get("case_id"), "user_task": case.get("user_task", ""), "jd": jd, "candidates": catalog_to_candidates(catalog), "matching_config": { "delegate_min_score": delegate_min, "confirm_band_min": confirm_min, }, } ``` It then embeds the payload directly in a model message: ```python user_content = ( "Produce on ...[truncated 2649 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/run_matching_benchmark_llm.py:129
Finding

Configurable API Endpoint Can Receive the API Key and Benchmark Content Without Transport or Host Validation

Content
View full analysis
str: url = base_url.rstrip("/") + "/chat/completions" body = json.dumps( { "model": model, "messages": messages, "temperature": temperature, "response_format": {"type": "json_object"}, }, ensure_ascii=False, ).encode("utf-8") req = urllib.request.Request( url, data=body, headers={ "Authorization": f"Bearer {api_key}", "Content-Type": "application/json", }, method="POST", ) try: with urllib.request.urlopen(req, timeout=timeout_s) as resp: raw = resp.read().decode("utf-8") ``` The endpoint can be supplied through an environment variable or command-line argument without scheme or hostname validation: ```python parser.add_argument( "--base-url", default=os.environ.get("OPENAI_BASE_URL", "https://api.openai.com/v1"), ) ``` The generator contains the same unrestricted request pattern: ```python url = base_url.rstrip("/") + "/chat/completions" body = json.dumps( { "model": model, "messages": messages, "temperature": temperature, }, ensure_ascii=False, ).encode("utf-8") req = urllib.request.Request( url, data=body, headers={ ...[truncated 3461 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (22)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

A skill presented as orchestration-only but capable of network API calls, local file generation, and subprocess-style benchmark workflows creates a misleading trust boundary. In a skill ecosystem, users may authorize it for management tasks without realizing it can exfiltrate data to remote endpoints or execute auxiliary workflows, which materially raises risk.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

A skill presented as orchestration-only but capable of network API calls, local file generation, and subprocess-style benchmark workflows creates a misleading trust boundary. In a skill ecosystem, users may authorize it for management tasks without realizing it can exfiltrate data to remote endpoints or execute auxiliary workflows, which materially raises risk.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

A skill presented as orchestration-only but capable of network API calls, local file generation, and subprocess-style benchmark workflows creates a misleading trust boundary. In a skill ecosystem, users may authorize it for management tasks without realizing it can exfiltrate data to remote endpoints or execute auxiliary workflows, which materially raises risk.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

A skill presented as orchestration-only but capable of network API calls, local file generation, and subprocess-style benchmark workflows creates a misleading trust boundary. In a skill ecosystem, users may authorize it for management tasks without realizing it can exfiltrate data to remote endpoints or execute auxiliary workflows, which materially raises risk.

Content

No source excerpt is available for this finding.

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · references/01-competency-model.md (reported line 29)May include surrounding context.

md
| Veto | Trigger |
|------|---------|
| **Exfiltration** | Skill instructs sending secrets, keys, `.env`, or private repo content to third parties |
| **Blind pipe** | `curl \| sh` / remote code without readable source and license |
| **Over-broad access** | Skill demands unrelated filesystem roots, SSH keys, or admin without justification |
| **Destructive default** | Mass delete, `rm -rf /`, formatting drives without explicit scoped paths |
| **Legal / safety** | Instructions enabling harm, fraud, or illegal activity |

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/01-competency-model.md (reported line 31)May include surrounding context.

md
| **Exfiltration** | Skill instructs sending secrets, keys, `.env`, or private repo content to third parties |
| **Blind pipe** | `curl \| sh` / remote code without readable source and license |
| **Over-broad access** | Skill demands unrelated filesystem roots, SSH keys, or admin without justification |
| **Destructive default** | Mass delete, `rm -rf /`, formatting drives without explicit scoped paths |
| **Legal / safety** | Instructions enabling harm, fraud, or illegal activity |

On veto: document in incident, set recruitment to **halt**, escalate per `07-escalation.md`.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/01-competency-model.md (reported line 31)May include surrounding context.

md
| **Exfiltration** | Skill instructs sending secrets, keys, `.env`, or private repo content to third parties |
| **Blind pipe** | `curl \| sh` / remote code without readable source and license |
| **Over-broad access** | Skill demands unrelated filesystem roots, SSH keys, or admin without justification |
| **Destructive default** | Mass delete, `rm -rf /`, formatting drives without explicit scoped paths |
| **Legal / safety** | Instructions enabling harm, fraud, or illegal activity |

On veto: document in incident, set recruitment to **halt**, escalate per `07-escalation.md`.

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · references/08-framework-evaluation.md (reported line 8)May include surrounding context.

md
integrity, every mandatory flow step (P01–P06), state artifacts, safety gates, and end-to-end scenarios.

## Goals

- **Coverage**: Measure whether the HR layer behaves as specified in `SKILL.md` and `references/01–07`, not only whether internal matching picks the right skill.
- **Separation**: Keep **automated** checks (schemas, scripts, gold cases) separate from **behavioral** checks (LLM-as-judge or human rubrics on transcripts).
- **Regression**: Any change to prompts, rubrics, or thresholds should have a defined place to re-run.

## Evaluation layers

| Layer | What | Primary method | Artifact |
|-------|------|----------------|----------|
| **L0** | Bundle shape and machine validity | Scripts, schema validators | CI-style log |
| **L1** | JD intake (P01) | Gold tasks → rubric / judge | Scored JD JSON |
| **L2** | Installed-pool match (P02) | Gold `cases.jsonl` + scorer | `outputs.jsonl`, metrics |
| **L3** | Delegate / recruit prompts (P03, P04) | Checklist

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
90% confidence
Finding

Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Content

Scanner excerpt · references/08-framework-evaluation.md (reported line 84)May include surrounding context.

md
**Intent:**

- **P03:** Handoff names the chosen skill, concrete inputs, success criteria, and what *not* to do; references incident logging.
- **P04:** Search brief is actionable, includes vetting reminders, and does not bypass safety in `01` / `04`.

**Method:** For fixed JDs (from L1 or L2), generate P03/P04 outputs. Use a **binary checklist** (human or judge):

Instruction Override

High
Category
Prompt Injection
Confidence
90% confidence
Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · references/08-framework-evaluation.md (reported line 84)May include surrounding context.

md
**Intent:**

- **P03:** Handoff names the chosen skill, concrete inputs, success criteria, and what *not* to do; references incident logging.
- **P04:** Search brief is actionable, includes vetting reminders, and does not bypass safety in `01` / `04`.

**Method:** For fixed JDs (from L1 or L2), generate P03/P04 outputs. Use a **binary checklist** (human or judge):

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · references/08-framework-evaluation.md (reported line 89)May include surrounding context.

md
- **From ClawHub / CLI:** prefer documented commands such as **`openclaw skills install …`** and **`openclaw skills update --all`** per [ClawHub](https://docs.openclaw.ai/tools/clawhub); installs into the **active workspace** `skills/` tree unless your setup differs.
- **From git:** cloning or copying into one of the skill roots above is fine; log **`source_url`** in `.skill-hr/registry.json`.
- **Safety:** treat third-party skills as untrusted; avoid silent **`curl | sh`**. Gateway-backed installs may run a **dangerous-code scanner**—still apply **`references/01-competency-model.md`** vetoes and user confirmation before risky steps.

## Sandbox and env

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · references/hosts/openclaw.md (reported line 76)May include surrounding context.

md
- **From ClawHub / CLI:** prefer documented commands such as **`openclaw skills install …`** and **`openclaw skills update --all`** per [ClawHub](https://docs.openclaw.ai/tools/clawhub); installs into the **active workspace** `skills/` tree unless your setup differs.
- **From git:** cloning or copying into one of the skill roots above is fine; log **`source_url`** in `.skill-hr/registry.json`.
- **Safety:** treat third-party skills as untrusted; avoid silent **`curl | sh`**. Gateway-backed installs may run a **dangerous-code scanner**—still apply **`references/01-competency-model.md`** vetoes and user confirmation before risky steps.

## Sandbox and env

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding

The skill declares no explicit tool scope while its instructions clearly contemplate sensitive capabilities including file writes, network access, shell execution, and environment use. Missing permission scoping can cause the host to grant broader access than users expect, increasing the chance of unsafe installs, remote script execution, or unintended filesystem changes.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger description is extremely broad, covering new multi-step tasks, skill management, tuning, failures, and delegation. Overbroad routing can cause this skill to intercept tasks outside its intended scope, which is especially risky here because the skill can influence installation, delegation, registry state, and potentially high-privilege operational flows.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · examples/registry.example.json (reported line 14)May include surrounding context.

json
{
      "id": "pdf",
      "name": "pdf",
      "install_path": "~/.claude/skills/pdf/SKILL.md",
      "status": "active",
      "added_at": "2026-04-01T10:00:00Z",
      "last_used_at": "2026-04-03T09:15:00Z",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/generate_cases.py (reported line 14)May include surrounding context.

python
Example (PowerShell):
  $env:OPENAI_API_KEY = "sk-..."
  $env:OPENAI_BASE_URL = "https://api.duckcoding.ai/v1"
  python generate_cases.py --model gpt-5-codex --out generated_cases.jsonl
"""

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/generate_cases.py (reported line 321)May include surrounding context.

python
Example (PowerShell):
  $env:OPENAI_API_KEY = "sk-..."
  $env:OPENAI_BASE_URL = "https://api.duckcoding.ai/v1"
  python generate_cases.py --model gpt-5-codex --out generated_cases.jsonl
"""

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/generate_cases.py (reported line 10)May include surrounding context.

python
Environment:
  OPENAI_API_KEY   Required (unless --dry-run).
  OPENAI_BASE_URL  Optional; default ``https://api.openai.com/v1``.

Example:
  set OPENAI_API_KEY=sk-...

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/generate_cases.py (reported line 320)May include surrounding context.

python
Environment:
  OPENAI_API_KEY   Required (unless --dry-run).
  OPENAI_BASE_URL  Optional; default ``https://api.openai.com/v1``.

Example:
  set OPENAI_API_KEY=sk-...

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/run_matching_benchmark_llm.py (reported line 10)May include surrounding context.

python
Environment:
  OPENAI_API_KEY   Required (unless --dry-run).
  OPENAI_BASE_URL  Optional; default ``https://api.openai.com/v1``.

Example:
  set OPENAI_API_KEY=sk-...

External Transmission

Medium
Category
Data Exfiltration
Confidence
73% confidence
Finding

The script defaults to transmitting benchmark payloads to an external API endpoint and also allows OPENAI_BASE_URL to redirect traffic to any configured server. In this HR/matching context, case payloads may contain task descriptions, job requirements, and skill catalog excerpts, so sending them off-host can expose potentially sensitive internal operational data if the endpoint is untrusted or not explicitly approved.

Content

Scanner excerpt · scripts/run_matching_benchmark_llm.py (reported line 184)May include surrounding context.

python
parser.add_argument("--model", default="gpt-4o-mini")
    parser.add_argument(
        "--base-url",
        default=os.environ.get("OPENAI_BASE_URL", "https://api.openai.com/v1"),
    )
    parser.add_argument("--temperature", type=float, default=0.2)
    parser.add_argument("--sleep", type=float, default=0.35, help="seconds between calls")

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/run_matching_benchmark_llm.py (reported line 306)May include surrounding context.

python
str(args.out.resolve()),
        ]
        print("Running:", " ".join(cmd))
        return subprocess.call(cmd)

    return 0

Static analysis

No suspicious patterns detected.