ClawHub
Back to skill

Security audit

Skill Studio

Security checks for vulnerabilities and agentic risk

Overview

This is a legitimate skill-building helper, but its auto-fix workflow can modify the wrong local SKILL.md file and its security validation is too weak to rely on.

Review this skill before installing. It is not trying to hide destructive behavior, but do not rely on its auto-fix command as written unless you first pass an explicit target path, review a diff, and keep a backup. Treat its security validation as a basic lint check, not proof a generated skill is safe. Verify the ClawHub CLI package and version before running the global npm install or entering authentication tokens.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:215
Finding

Validation and auto-fix scripts operate on an unintended default file

Content
View full analysis
1 else 'SKILL.md' ) ``` The auto-fix workflow repeats the same error: ```bash python3 << 'PYEOF' ``` ```python def fix_metadata(filepath): with open(filepath, 'r', encoding='utf-8') as f: content = f.read() fixes_applied = [] # Fix 1: Convert multi-line YAML metadata to single-line JSON # Pattern: metadata:\n openclaw:\n ... multi_line_pattern = r'(metadata:)\n(\s+openclaw:\n(?:\s+\w+:.*\n)+)' match = re.search(multi_line_pattern, content) if match: # Parse the multi-line YAML structure yaml_block = match.group(2) # Extract values using regex emoji = re.search(r'emoji:\s*["\']?([^"\'\n]+)["\']?', yaml_block) emoji = emoji.group(1) if emoji else "🔧" bins = re.findall(r'-\s+(\w+)', re.search(r'bins:\s*\n((?:\s+-\s+\w+\n)+)', yaml_block).group(1) if re.search(r'bins:\s*\n((?:\s+-\s+\w+\n)+)', yaml_block) else "") # Handle requires_env (wrong format) env_match = re.search(r'requires_env:\s*\n\s*-\s*name:\s*(\w+)', yaml_block) env_vars = [env_match.group(1)] if env_match else [] primary_env = env_vars[0] if env_vars else "" # Build JSON metadata metadata_json = { "openclaw": { "emoji": emoji, "requires": { "bins": bins, "env": env_vars } } } if primary_env: metadata_json["openclaw"]["primaryEnv"] = primary_env # Replace in content new_metadata = f'm ...[truncated 2875 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:280
Finding

Security validation can be bypassed with equivalent command syntax

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
references/publish-guide.md:12
Finding

ClawHub CLI is installed globally from an unpinned npm package

Content
View full analysis
/dev/null; then echo "❌ clawhub CLI not installed" echo "" echo "Install with:" echo " npm install -g clawhub" exit 1 fi ``` ### Technical Analysis The documented command installs the current registry version of the `clawhub` npm package globally. It does not pin a reviewed version, identify an expected registry or publisher, verify package integrity, or provide a lockfile. npm installation may execute package lifecycle scripts. If the package, a transitive dependency, the registry account, or the resolution source is compromised, installation can execute attacker-controlled code with the user's privileges. Global installation also places executable tooling into a shared command location, increasing the persistence and scope of an affected package compared with a project-local installation. No evidence establishes that the referenced package is currently malicious. The finding concerns the unsafe dependency acquisition and installation practice. ### Attack Path 1. An attacker compromises the package publisher, a dependency, or the package-resolution channel, or publishes a malicious release under the expected package identity. 2. A user follows the audit project's installation instruction. 3. `npm` resolves the latest available `clawhub` release because no version is pinned. 4. npm installs the package globally and may execute lifecycle scripts during installation. 5. Malicious installation logic runs with the invoking user's permissions. 6. The installed global `clawhub` executable can ...[truncated 810 chars]
Remediation
View remediation
``` 2. Document the authoritative package name, publisher, source repository, and expected npm registry. 3. Verify package provenance and integrity against a trusted release before installation. 4. Prefer a project-local development dependency with a lockfile over global installation where operationally possible. 5. Disable lifecycle scripts during acquisition when compatible with the package, then explicitly review any required setup. 6. Recommend running installation without administrative privileges. 7. Establish a controlled update process that reviews release notes, package contents, dependency changes, and integrity metadata before changing the pinned version. 8. Warn users not to enter authentication tokens until they have verified the installed CLI binary and package provenance. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (14)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 299)May include surrounding context.

md
errors, warnings = validate_skill(sys.argv[1] if len(sys.argv) > 1 else 'SKILL.md')

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 410)May include surrounding context.

md
errors, warnings = validate_skill(sys.argv[1] if len(sys.argv) > 1 else 'SKILL.md')

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 548)May include surrounding context.

md
| Missing name/description | Error | ❌ No |
| Description length | Warning | ❌ No |
| curl\|bash pattern | Error | ❌ No |
| sudo auto-install | Warning | ❌ No |
| HTTP endpoints | Warning | ❌ No |
| SKILL.md too long | Warning | ❌ No |

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · references/validation-rules.md (reported line 18)May include surrounding context.

emoji: "📄" requires: bins: - curl

text

**Correct:**

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger conditions include broad phrases such as "Help me make a plugin for OpenClaw" and "Create a new skill," which can overlap with common assistance requests and cause this skill to activate in situations the user may not have intended. Because the skill can generate files, run validation scripts, and guide publishing workflows, over-broad activation increases the chance of unintended file manipulation or tool use in unrelated conversations.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 283)May include surrounding context.

md
if 'curl -fsSL' in content and '|' in content and 'bash' in content:
        errors.append("❌ Dangerous: curl|bash pattern detected")
    if re.search(r'sudo\s+(apt|yum|dnf)\s+install', content):
        warnings.append("⚠️ Contains sudo install (should prompt user manually)")
    if 'eval(' in content or 'exec(' in content:
        warnings.append("⚠️ Contains eval/exec (potential security risk)")

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 548)May include surrounding context.

md
if 'curl -fsSL' in content and '|' in content and 'bash' in content:
        errors.append("❌ Dangerous: curl|bash pattern detected")
    if re.search(r'sudo\s+(apt|yum|dnf)\s+install', content):
        warnings.append("⚠️ Contains sudo install (should prompt user manually)")
    if 'eval(' in content or 'exec(' in content:
        warnings.append("⚠️ Contains eval/exec (potential security risk)")

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The auto-fix script writes modified content directly back to SKILL.md without an explicit approval gate at the moment of modification. In a conversational agent context, silent or loosely gated file writes can overwrite user-authored content, apply incorrect regex-based transformations, or be chained with broad triggers to modify files unexpectedly.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/validation-rules.md (reported line 115)May include surrounding context.

Rule 8: No Auto sudo Install (WARNING)

Discouraged:

bash

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/validation-rules.md (reported line 119)May include surrounding context.

Rule 8: No Auto sudo Install (WARNING)

Discouraged:

bash

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/validation-rules.md (reported line 124)May include surrounding context.

Rule 8: No Auto sudo Install (WARNING)

Discouraged:

bash

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/validation-rules.md (reported line 135)May include surrounding context.

Wrong:

bash
curl http://api.example.com/data

Correct:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/validation-rules.md (reported line 140)May include surrounding context.

Correct:

bash
curl https://api.example.com/data

Auto-fix: ❌ No (warn user)

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · LICENSE.txt (reported line 12)May include surrounding context.

text
permit persons to whom the Software is furnished to do so.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE
FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER

Static analysis

No suspicious patterns detected.