ClawHub
Back to skill

Security audit

clawhub-install

Security checks for vulnerabilities and agentic risk

Overview

This skill openly installs ClawHub skills, but its installer can overwrite or delete local content too broadly and lacks package integrity checks.

Only install this after reviewing or fixing the installer. Prefer the official ClawHub/OpenClaw install path, or require strict skill-name validation, checksum/signature verification, safe temporary directories, archive-entry validation, and explicit confirmation before replacing existing skills.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)

T03 · Remote Payload Retrieval and Execution

Error
Location
scripts/install.sh:35
Finding

Unverified Remote Skill Payload Installation

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/install.sh:18
Finding

Path Traversal Enables Deletion and Replacement Outside the Skills Directory

Content
View full analysis
/dev/null) if [ -z "$workspace_path" ]; then echo -e "${RED}Error: Could not get workspace path. Make sure OpenClaw is configured.${NC}" return 1 fi echo "Workspace: $workspace_path" # Step 2: Download skill package echo "Downloading $skill_name from ClawHub..." download_url="https://wry-manatee-359.convex.site/api/v1/download?slug=${skill_name}" zip_path="/tmp/${skill_name}.zip" if curl -L -o "$zip_path" "$download_url" --fail --silent --show-error; then echo "Downloaded successfully" else echo -e "${RED}Error: Failed to download ${skill_name}. The skill may not exist or rate limited.${NC}" rm -f "$zip_path" return 1 fi # Check if zip file is valid if [ ! -s "$zip_path" ]; then echo -e "${RED}Error: Downloaded file is empty${NC}" rm -f "$zip_path" return 1 fi # Step 3: Extract to workspace/skills skills_dir="$workspace_path/skills" target_dir="$skills_dir/$skill_name" echo "Extracting to $target_dir..." # Create skills directory if not exists mkdir -p "$skills_dir" # Remove existing skill if it exists if [ -d "$target_dir" ]; then echo "Removing existing $skill_name..." rm -rf "$target_dir" fi # Create the skill directory mkdir -p "$target_dir" ``` ### Technical Analysis The script accepts `skill_name` directly from a command-line argument and uses it as a filesystem path component. It applies no slug ...[truncated 1730 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/install.sh:35
Finding

Unsafe ZIP Extraction May Write Outside the Installation Directory

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/install.sh:35
Finding

Predictable Temporary Archive Path Permits Symlink and Race Attacks

Content
View full analysis
.zip` as a symbolic link to another file. When `curl -o` opens that path, it may follow the link and overwrite or truncate the linked target with the downloaded response. The attacker can also race cleanup and extraction operations involving the predictable path. The user-controlled `skill_name` further increases the range of possible temporary paths because path separators and traversal components are not rejected. ### Attack Path 1. A local attacker predicts a Skill name that a victim will install. 2. The attacker creates the corresponding predictable `/tmp/.zip` path as a symbolic link to a file writable by the victim. 3. The victim runs the installer. 4. `curl -o` opens the predictable path and follows the attacker-created link. 5. The linked file is overwritten with the remote archive data. 6. Depending on the selected target, the victim suffers data destruction or modification of configuration or executable content. ### Impact Assessment The attacker can cause the invoking account ...[truncated 414 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script accepts an arbitrary user-supplied skill name and uses it to construct both /tmp and installation paths, then performs destructive operations like rm -rf on the derived target directory. Because skill_name is not validated or canonicalized, values containing path traversal components or path separators could cause deletion or extraction outside the intended skills directory, making this a real arbitrary file overwrite/delete risk.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill invokes shell-based installation behavior but declares no tool scope or permissions, which weakens containment and reviewability for a workflow that downloads remote content and installs it into the local workspace. In this context, the risk is elevated because the skill explicitly bypasses the official installation path and fetches packages from a direct URL, increasing the chance of unreviewed or tampered content being introduced.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The documentation states that existing skills may be removed and skipped but does not clearly warn that installation can overwrite or delete an existing skill directory in the configured workspace. That creates a real integrity and availability risk: users may unintentionally destroy local skill contents or replace a trusted skill with newly downloaded remote content.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The script downloads and installs code from a remote third-party endpoint directly into the local skills workspace, explicitly bypassing official installation controls and without any signature, checksum, publisher, or content verification. This creates a supply-chain risk: a compromised service, malicious skill, or man-in-the-middle at the hosting layer could deliver attacker-controlled content that the agent later executes or trusts.

Content

Scanner excerpt · scripts/install.sh (reported line 39)May include surrounding context.

sh
download_url="https://wry-manatee-359.convex.site/api/v1/download?slug=${skill_name}"
    zip_path="/tmp/${skill_name}.zip"

    if curl -L -o "$zip_path" "$download_url" --fail --silent --show-error; then
        echo "Downloaded successfully"
    else
        echo -e "${RED}Error: Failed to download ${skill_name}. The skill may not exist or rate limited.${NC}"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The installer unconditionally removes an existing target directory with rm -rf before replacement, with no confirmation, backup, or safety check. In isolation this is unsafe behavior; combined with the unvalidated target_dir construction, it can magnify destructive impact and lead to accidental or attacker-influenced data loss.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.