ClawHub
Back to skill

Security audit

hello-example

Security checks for vulnerabilities and agentic risk

Overview

The skill itself does not execute code, but the published package includes a file it explicitly says should have been excluded, exposing private-looking configuration content.

Review this package before installing. It appears to be a harmless ignore-file test with no executable behavior, but its published contents demonstrate a failed exclusion of private-looking config; publishers should remove secret.md and rebuild from a clean package before distribution.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
secret.md:1
Finding

Private Configuration File Included in Published Artifact

Content
View full analysis

Vulnerability Details

File Location: secret.md, lines 1–6
Vulnerability Type: Sensitive information exposure caused by ineffective publication exclusions
Risk Level: Medium

Evidence

text
# SECRET — This file should NOT be published

This file contains "private" config. If you see this on ClawHub, the .clawhubignore is NOT working.

vault_path: /Users/hsw/super/private/path
api_key: this-is-fake-but-should-be-excluded

SKILL.md, lines 7–15, confirms that secret.md was intended to be excluded from the published package:

text
This is a test skill to verify `.clawhubignore` works correctly.

## What this skill does

Nothing useful. It exists to test whether `secret.md` gets excluded on publish.

If you downloaded this skill from ClawHub and can see `secret.md` in the folder — the ignore mechanism is broken.
If `secret.md` is absent — it works correctly.

Technical Analysis

The artifact contains secret.md even though the skill documentation explicitly states that this file must be excluded during publication. This demonstrates that the intended ignore control was absent, incorrectly configured, or ineffective in the packaging process.

The included file exposes a user-specific absolute filesystem path, revealing the local username and directory structure. It also contains an API-key-shaped value. The file explicitly identifies that value as fake, so this audit does not classify it as a compromised credential. Nevertheless, the failed exclusion boundary could expose genuine credentials or private configuration if the same publication process were used with real data.

Attack Path

  1. A skill author places private configuration or credentials in a file expected to be excluded by .clawhubignore.
  2. The packaging or publication process fails to apply the exclusion rule.
  3. The private file is incorporated into the distributed artifact.
  4. A recipient downloads or in ...[truncated 945 chars]
Remediation
View remediation

Remediation Suggestions

  1. Add secret.md and all other private configuration patterns to .clawhubignore, then ensure that the ignore file itself is included in the source project and recognized by the publishing tool.
  2. Remove secret.md from the artifact and rebuild it from a clean workspace before publication.
  3. Add a pre-publication check that inspects the final package contents and fails when denylisted files, absolute user paths, private keys, tokens, or credential-like values are detected.
  4. Test ignore behavior against the assembled artifact rather than relying only on source-tree configuration.
  5. Store genuine secrets in an external secret manager or environment variables instead of files within the publishable project tree.
  6. Use clearly synthetic usernames, paths, and placeholders in test fixtures to avoid leaking workstation metadata.
  7. If a real secret is ever included in a published artifact, revoke and rotate it immediately, remove the affected release, and review access logs for unauthorized use.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep