ClawHub
Back to skill

Security audit

Skill Safety Verifier

Security checks for vulnerabilities and agentic risk

Overview

This is a plausible skill-safety scanner, but its install and network-check behavior can make its security results untrustworthy.

Review this carefully before installing. The core idea is legitimate, but do not rely on its verdicts until TLS verification is fixed, scan failures are reported as incomplete instead of clean, and installation paths are pinned or checksum-verified. Run it in a constrained environment and avoid following the direct-download execution instructions from a mutable branch.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
analyzer.py:111
Finding

TLS certificate verification is explicitly disabled for security advisory requests

Content
View full analysis
Remediation
View remediation

T03 · Remote Payload Retrieval and Execution

Error
Location
README.md:68
Finding

Documentation creates an unpinned remote payload retrieval and execution path

Content
View full analysis
Remediation
View remediation
analyzer.py' | sha256sum --check - ``` - Pin both `analyzer.py` and `risk_radar.py` to the same immutable release to prevent version mismatch. - Protect the upstream repository with multifactor authentication, branch protection, mandatory review, and signed commits or tags. - Apply the same corrections to both `README.md` and `README_zh.md`. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
analyzer.py:201
Finding

Security scan failures are suppressed and converted into incomplete or zero-risk findings

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
requirements.txt:2
Finding

Third-party dependency is unbounded and is not covered by the analyzer’s dependency checks

Content
View full analysis
=2.28.0 ``` From `setup.py`: ```python install_requires=[ 'requests>=2.28.0', ], ``` The dependency scanner only checks JavaScript package metadata: **File Location**: `analyzer.py`, lines 201-220 ```python # Check package.json pkg_json = self.skill_path / 'package.json' if pkg_json.exists(): try: with open(pkg_json, 'r', encoding='utf-8') as f: pkg = json.load(f) deps = {} deps.update(pkg.get('dependencies', {})) deps.update(pkg.get('devDependencies', {})) for dep_name in deps.keys(): vulns = self.advisor.check_package(dep_name) vulnerabilities.extend(vulns) except: pass ``` ### Technical Analysis The requirement allows any future version of `requests` at or above 2.28.0. Installation results can therefore change over time without any project code change or renewed review. There is no lock file, upper bound, hash verification, or reproducible dependency set. The risk is compounded by the fact that `analyzer.py` audits only `package.json`. It does not inspect `requirements.txt`, Python project metadata, installed Python distributions, versions, or transitive dependencies. Thus, the project’s own declared Python dependency is outside the scope of its vulnerability-checking logic. The audited implementation uses `urllib.request`, not `requests`, so the declared dependency also appears unnecessary for the shown runtime behavior. Installing an unused package expands the supply-chain and attack surface without supporting the minimum functionality. ### Attack Path 1. A user runs `pip install -r requirements.txt` or `pip install -e .`. 2. The package resolver s ...[truncated 1171 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (23)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill's stated purpose is safety vetting, but the documented behavior includes undeclared outbound network access, filesystem traversal/cache writes, and the finding notes insecure TLS handling not reflected in the description or permissions. Description-behavior mismatch is dangerous because users may trust a 'security' skill more than normal, while hidden or under-disclosed capabilities expand attack surface and can enable data leakage or tampered scan results.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · analyzer.py (reported line 51)May include surrounding context.

python
],
    'data': [
        r'os\.environ',
        r'process\.env',
        r'os\.getenv\(',
        r'os\.putenv\(',
    ],

Unrestricted Tool Access

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · README.md (reported line 10)May include surrounding context.

md
## Why This Matters

AI agents run with elevated permissions and can:
- Execute arbitrary commands
- Access file systems
- Make network requests
- Read environment variables

Unrestricted Tool Access

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

md
## Why This Matters

AI agents run with elevated permissions and can:
- Execute arbitrary commands
- Access file systems
- Make network requests
- Read environment variables

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The README states that SSL verification can be disabled, which normalizes an unsafe troubleshooting step for a security-focused tool. Even though it says 'not recommended for production,' encouraging this without strong guidance can lead users to disable TLS checks and become vulnerable to man-in-the-middle attacks or tampered advisory responses.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 245)May include surrounding context.

md
## 相关链接

- ClawdHub (https://clawhub.com) - Skill 市场
- GitHub Advisory API (https://api.github.com/advisories)
- OpenClaw 文档 (https://docs.openclaw.ai)

---

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README_zh.md (reported line 245)May include surrounding context.

md
## 相关链接

- ClawdHub (https://clawhub.com) - Skill 市场
- GitHub Advisory API (https://api.github.com/advisories)
- OpenClaw 文档 (https://docs.openclaw.ai)

---

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding

The skill describes behaviors that imply file reads, file writes, network access, and shell usage, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates a transparency and governance gap: an installer or orchestrator cannot reliably enforce least privilege, and users may authorize a skill without understanding its effective capabilities.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The trigger regex is broad and can match common installation or safety-related phrasing outside the narrow context of deliberate skill vetting. Over-broad automatic activation is risky for a skill with network, filesystem, or shell-related behavior because it may run unexpectedly on unrelated user requests and perform side effects without clear intent.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

This skill intentionally contacts an external service (GitHub Advisory API), which is consistent with vulnerability lookups, but it still represents external transmission and should be treated as a real security-relevant behavior. In a security-vetting context this is less suspicious than arbitrary exfiltration, yet it can still leak metadata about what is being scanned and creates dependency on remote responses.

Content

Scanner excerpt · SKILL.md (reported line 164)May include surrounding context.

md
使用 GitHub Advisory API 获取真实漏洞数据，不阻塞安装流程。

**API**: `https://api.github.com/advisories`  
**认证**: 无需 Token（匿名 60次/小时）  
**TTL**: 本地缓存 24 小时

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

Referencing 'npx skills' without a pinned version allows the latest published package to be resolved at install time, which introduces supply-chain risk. If the upstream package is compromised or a breaking change is introduced, the verifier workflow could execute unreviewed code unexpectedly.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The top-level description states in Chinese that the skill automatically analyzes skill safety, while the rest of the program and CLI are in English. This mixed-language presentation creates a locale/language policy concern because it imposes a specific language in user-facing natural language without any opt-in or documented regional justification.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The hardcoded GitHub API endpoint confirms external transmission behavior in a tool that primarily analyzes local content. This can leak usage patterns, create network dependency during security review, and allow remote influence over results, especially because the implementation later disables TLS certificate validation.

Content

Scanner excerpt · analyzer.py (reported line 99)May include surrounding context.

python
def __init__(self, cache_manager: CacheManager):
        self.cache = cache_manager
        self.api_url = 'https://api.github.com/advisories'
        self.advisories = None
    
    def fetch_advisories(self, timeout: int = 5) -> List[Dict]:

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The analyzer makes live outbound requests to GitHub's Advisory API during local skill analysis, which introduces unnecessary external communication and metadata leakage about user activity or analyzed packages. In a security-vetting tool, unexpected network access expands the trust boundary and creates privacy, availability, and supply-chain concerns if the remote source is unavailable or manipulated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

该文件内容明确为中文版本，且顶部导航仅在文档层面区分中英文，没有说明技能是否会根据用户偏好选择语言。若该 README 被用作技能说明的一部分，可能构成未获用户明确选择的语言/区域偏好约束。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The document presents user-facing content in both English and Chinese, but does not state whether the skill will respond in the user's preferred language or provide an opt-in for locale selection. This can conflict with language/locale policy expectations when a skill implicitly forces or assumes a language presentation style.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

The top-level documentation says the analyzer performs 'Socket 扫描' alongside advisory and code-pattern analysis. The implementation only scans files with regexes, reads package manifests, and fetches GitHub advisories; there is no socket enumeration or connection scanning logic anywhere in the file.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
96% confidence
Finding

The dependency is specified as requests>=2.28.0 rather than being pinned to an exact version, which makes builds non-reproducible and can allow installation of an unexpected or newly vulnerable release. In a security-focused skill, this weakens supply-chain assurance because reviewers cannot reliably determine which version will be installed in different environments.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text
# Requirements
requests>=2.28.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
90% confidence
Finding

Because the manifest does not pin requests to a specific reviewed version, it is impossible to verify whether the installed package includes fixes for known advisories. This creates avoidable uncertainty in dependency risk and could expose deployments to known requests flaws depending on resolver behavior and installation time.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.