T08 · Insecure Dependencies
Error
- Location
SKILL.md:32- Finding
Mutable npm Package Is Downloaded and Executed Without Version Pinning
- Content
View full analysis
- Remediation
View remediation
Security audit
Up Skill To Clawhub
Security checks for vulnerabilities and agentic risk
Overview
This skill is aligned with publishing OpenClaw skills, but it needs review because it uses mutable CLI execution with tokens and a helper scanner that can expose secrets in logs.
Install only if you are comfortable letting the agent inspect and edit the target skill folder and publish it to ClawHub. Prefer a pinned ClawHub CLI version, avoid passing tokens directly on the command line, review the exact files and diffs before publication, and treat scanner output as sensitive because it may contain secrets.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:32- Finding
ClawHub API Token Is Passed Through a Command-Line Argument
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/scan_sensitive.py:138- Finding
Sensitive-Data Scanner Prints Detected Secrets in Plaintext
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/scan_sensitive.py:45- Finding
Incomplete Scanner Can Incorrectly Declare a Folder Safe to Publish
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (25)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared purpose is publishing a skill, but the workflow also directs scanning local files for secrets and restoring original configuration afterward. That mismatch reduces user clarity about what the skill will actually access and do, which can mask extra file inspection and local modification behaviors beyond simple publishing.
- Content
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 91% confidence
- Finding
The manifest explicitly supports 'update skill', which implies modifying the skill package itself. Self-modifying or self-updating behavior is risky because it can rewrite trusted prompt content or metadata, making later reviews harder and potentially introducing unauthorized changes before publication.
- Content
md --- name: up-skill-to-clawhub description: Package and publish OpenClaw skills to ClawHub registry. Use when user wants to upload, publish, or update a skill to ClawHub. Triggers on phrases like "upload skill", "publish skill", "push to clawhub", "update skill on clawhub". --- # Up Skill to ClawHub / 上传技能到 ClawHub
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `SKILL.md` - Main skill documentation (required)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `SKILL.md` - Main skill documentation (required)
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 93% confidence
- Finding
The workflow instructs updating
SKILL.md, which is a write operation against a high-trust file that defines behavior and triggers. Modifying skill documentation or manifest content in the same workflow that publishes it creates a path for unreviewed prompt changes to be packaged and pushed externally.- Content
md ### Step 4: Update Documentation / 步骤 4：更新文档 **English**: Update SKILL.md with: - Version number in changelog - New features/changes - Bilingual (EN/CN) documentation
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill instructs the agent to inspect the skill folder structure and scan local contents for sensitive data, which implies file-read capability, but it does not declare any tool scope or permission boundary. This creates an authorization and transparency gap: an agent may read local files without an explicit manifest-level declaration of that access.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Broad triggers like 'upload skill' and 'publish skill' can cause the skill to activate in contexts where the user did not intend local scanning, credential use, or external publication. In this skill, accidental activation is more dangerous because it may lead to file reads, metadata edits, and transmission of local content to a remote registry.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
Using
npx clawhub@latestexecutes whatever package version is current at runtime, which is a supply-chain risk because behavior can change or a compromised upstream release could run arbitrary code. The risk is amplified here because the command is used with authentication tokens and for publishing local content.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
Using
npx clawhub@latestexecutes whatever package version is current at runtime, which is a supply-chain risk because behavior can change or a compromised upstream release could run arbitrary code. The risk is amplified here because the command is used with authentication tokens and for publishing local content.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
Using
npx clawhub@latestexecutes whatever package version is current at runtime, which is a supply-chain risk because behavior can change or a compromised upstream release could run arbitrary code. The risk is amplified here because the command is used with authentication tokens and for publishing local content.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
Using
npx clawhub@latestexecutes whatever package version is current at runtime, which is a supply-chain risk because behavior can change or a compromised upstream release could run arbitrary code. The risk is amplified here because the command is used with authentication tokens and for publishing local content.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
Using
npx clawhub@latestexecutes whatever package version is current at runtime, which is a supply-chain risk because behavior can change or a compromised upstream release could run arbitrary code. The risk is amplified here because the command is used with authentication tokens and for publishing local content.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
Using
npx clawhub@latestexecutes whatever package version is current at runtime, which is a supply-chain risk because behavior can change or a compromised upstream release could run arbitrary code. The risk is amplified here because the command is used with authentication tokens and for publishing local content.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
Using
npx clawhub@latestexecutes whatever package version is current at runtime, which is a supply-chain risk because behavior can change or a compromised upstream release could run arbitrary code. The risk is amplified here because the command is used with authentication tokens and for publishing local content.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
Using
npx clawhub@latestexecutes whatever package version is current at runtime, which is a supply-chain risk because behavior can change or a compromised upstream release could run arbitrary code. The risk is amplified here because the command is used with authentication tokens and for publishing local content.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
Using
npx clawhub@latestexecutes whatever package version is current at runtime, which is a supply-chain risk because behavior can change or a compromised upstream release could run arbitrary code. The risk is amplified here because the command is used with authentication tokens and for publishing local content.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
Using
npx clawhub@latestexecutes whatever package version is current at runtime, which is a supply-chain risk because behavior can change or a compromised upstream release could run arbitrary code. The risk is amplified here because the command is used with authentication tokens and for publishing local content.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
Using
npx clawhub@latestexecutes whatever package version is current at runtime, which is a supply-chain risk because behavior can change or a compromised upstream release could run arbitrary code. The risk is amplified here because the command is used with authentication tokens and for publishing local content.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
Using
npx clawhub@latestexecutes whatever package version is current at runtime, which is a supply-chain risk because behavior can change or a compromised upstream release could run arbitrary code. The risk is amplified here because the command is used with authentication tokens and for publishing local content.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
Using
npx clawhub@latestexecutes whatever package version is current at runtime, which is a supply-chain risk because behavior can change or a compromised upstream release could run arbitrary code. The risk is amplified here because the command is used with authentication tokens and for publishing local content.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
Using
npx clawhub@latestexecutes whatever package version is current at runtime, which is a supply-chain risk because behavior can change or a compromised upstream release could run arbitrary code. The risk is amplified here because the command is used with authentication tokens and for publishing local content.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
Using
npx clawhub@latestexecutes whatever package version is current at runtime, which is a supply-chain risk because behavior can change or a compromised upstream release could run arbitrary code. The risk is amplified here because the command is used with authentication tokens and for publishing local content.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
Using
npx clawhub@latestexecutes whatever package version is current at runtime, which is a supply-chain risk because behavior can change or a compromised upstream release could run arbitrary code. The risk is amplified here because the command is used with authentication tokens and for publishing local content.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The workflow tells the user to authenticate with an API token and publish local files to a remote registry, but it does not prominently disclose that credentials will be used and local skill contents will leave the machine. This weakens informed consent and increases the chance of unintended secret exposure or unauthorized publication.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file embeds Chinese alongside English in its primary description and usage text, and the script continues this pattern in user-facing output. Because the script does not offer a language or locale selection, it imposes a specific locale choice on all users rather than making it optional.
- Content
Static analysis
No suspicious patterns detected.