Publisher

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:14 AM UTC
• Version: 1.0.6

Overview

This skill is a publishing helper, but it can upload the whole current directory to a public GitHub repository without enough file scoping or secret-safety checks.

Review the directory carefully before using this skill. It can initialize git, commit everything under the current directory that is not ignored, create a public GitHub repository, push the contents, and publish to ClawdHub. Do not run it in a folder containing secrets, private code, .env files, logs, backups, or unreviewed files unless the script is tightened first with file previews, allowlists, secret scanning, and private-by-default repository creation.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/publish.sh:174

Finding

Unrestricted Directory Contents May Be Published to a Public GitHub Repository

Content

View full analysis

/dev/null 2>&1; then gh repo create "$SKILL_NAME" --public --source=. --remote=origin --push || { ``` ### Technical Analysis The script executes `git add .`, recursively staging every non-ignored file under the selected skill directory. It subsequently invokes `gh repo create` with the `--public` and `--push` options, causing the staged contents to be uploaded to a publicly accessible GitHub repository. No controls are implemented to: - Restrict publication to an explicit allowlist of expected skill files. - Detect credentials, private keys, access tokens, `.env` files, logs, backups, or local configuration. - Verify that an effective `.gitignore` exists. - Display and validate the complete staged file list before publication. - Scan the commit or Git history for secrets. - Obtain a dedicated confirmation acknowledging that the repository will be public. The general publication confirmation does not identify the files that will be exposed. Although ignored files are not staged, the script does not establish or validate ignore rules. Sensitive files already tracked in an existing repository may also be pushed through the existing-repository branch. ### Attack Path 1. A sensitive file, such as `.env`, a private key, an API token file, a configuration backup, or a log containing credentials, is present in the selected skill directory. 2. The file is not covered by an existing `.gitignore` rule, or it is already tracked by Git. 3. The user approves the general GitHub and ClawdHub publicat ...[truncated 1294 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · README.md (reported line 170)May include surrounding context.

md

**Examples:**
- "Automatically refresh tokens before expiry"
- "Automatically backup workspace daily"
- "Automatically update skills on schedule"

**Validation (good one-liners have):**
- ✅ Specific (not generic)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill’s top-level description frames it as a documentation/publishing helper, but the documented behavior includes sensitive actions: modifying local files, creating repositories, pushing code to GitHub, and publishing to ClawdHub. This mismatch can mislead users about the scope and risk of execution, increasing the chance they approve actions that expose source code or secrets to remote services.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 148)May include surrounding context.

text

Keep [thing] [desired state] [timeframe]

Example: "Keep your Claude access token fresh 24/7"

Pattern B: Elimination

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

text

Keep [thing] [desired state] [timeframe]

Example: "Keep your Claude access token fresh 24/7"

Pattern B: Elimination

text

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.

md

- `SKILL.md` (name, description, requirements)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The script self-modifies repository content by rewriting SKILL.md based on interactive input, which can silently alter package metadata before publication. In a publishing tool this is contextually relevant, but it is still risky because it changes tracked files automatically and those changes are subsequently committed/pushed, potentially causing unintended metadata tampering or accidental publication of misleading content.

Content

Scanner excerpt · scripts/publish.sh (reported line 143)May include surrounding context.

sh

echo "✅ Chosen: $CHOSEN_DESC"
    echo ""
    
    # Update SKILL.md frontmatter if needed
    if [ "$SKILL_DESC" != "$CHOSEN_DESC" ]; then
        echo "📝 Updating SKILL.md frontmatter..."
        awk -v desc="$CHOSEN_DESC" '

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README prominently advertises automatic publishing to GitHub and ClawdHub, including repository creation, but does not give a clear up-front warning that running the tool may push local code and metadata to external services. In a publishing skill, this behavior is expected, but insufficient disclosure can still lead users to expose private or incomplete code by mistake.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The publishing workflow describes creating GitHub repositories and pushing code without warning about potential data exposure, accidental publication of private code, or irreversible remote changes. In a skill that automates release actions, omission of these risks makes unsafe use more likely, especially for users running it from the wrong directory or with unreviewed files present.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script's stated purpose is documentation/publishing assistance, but it also performs networked side effects: creating a GitHub repository, pushing code, and publishing to ClawdHub. This is dangerous because users may invoke it expecting local formatting/help, while it actually transfers repository contents to external services, increasing the risk of unintended data disclosure if run in the wrong directory or with sensitive files present.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README describes generating and overwriting README.md and updating SKILL.md frontmatter, but it does not clearly warn users that local project files will be modified. This is a safety and integrity issue rather than an exploit primitive, but undisclosed file modification can still cause accidental loss of local edits or unintended content changes.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The inline comment says 'Generate README (simplified - use template)', which implies the script will create README.md. In practice, if README.md is missing, the script only prints instructions and waits for the user to create it manually, so the documentation overstates what the code does.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

When GitHub repo creation fails, the script writes a reminder note to /tmp about granting GitHub access. That local reminder-file capability is not an obvious requirement of a skill whose stated purpose is making skills understandable/publishable, and it adds side effects outside the core publishing flow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

On GitHub repo creation failure, the script creates /tmp/github-access-reminder.txt, which is a filesystem write affecting the local system. Although the script logs many major actions, it does not warn the user that it will create this temporary file before doing so.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.