Security audit

Openclaw Huggingface

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Hugging Face CLI reference, but users should be careful with tokens, uploads, and delete commands.

Install only if you intend to let the agent use Hugging Face account operations. Use a least-privilege HF_TOKEN, review files before any upload, confirm repository visibility, and require explicit approval before delete or broad upload commands.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill instructs users to set `HF_TOKEN` but does not warn that the token is a sensitive secret that grants access to Hugging Face resources. In an agent setting, this omission increases the risk of exposing credentials in shell history, logs, screenshots, prompts, or command arguments.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill includes `hf repos delete` as a normal example without any warning, confirmation guidance, or emphasis on irreversibility. In an agent skill context, destructive commands are more dangerous because users may treat examples as approved operational steps and accidentally delete remote repositories or data.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill documents multiple `hf upload` operations but does not warn that local files and directories will be transmitted to a remote third-party service. This is risky in an agent context because examples like uploading `.` can unintentionally publish sensitive source code, credentials, datasets, or proprietary artifacts.

Static analysis

No suspicious patterns detected.