ClawHub
Back to skill

Security audit

skill-forge

Security checks for vulnerabilities and agentic risk

Overview

Skill Forge is a legitimate skill-creation tool, but its CLI includes unsafe command execution and installation paths that need review before use.

Review and patch the CLI before installing or running it on third-party skills. Avoid running check, install-deps, wrap, package --zip, or install --openclaw with untrusted skill names, _meta.json dependency values, or tool paths until shell execution is replaced with argument-array APIs, names are validated, paths are contained, and package/OpenClaw installs require clear confirmation.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/skill-creator.js:294
Finding

Shell Command Injection Through Untrusted Dependency Names

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/skill-creator.js:62
Finding

Unsanitized Skill Names Permit Path Traversal and Windows Shell Injection

Content
View full analysis
[--template=
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/skill-creator.js:856
Finding

Generated Executable Wrapper Embeds an Unquoted Tool Path

Content
View full analysis
[--script=] [--binary=]'); return; } // Check if tool exists if (!fs.existsSync(toolPath)) { console.error(`Error: ${toolType} not found at ${toolPath}`); return; } console.log(`Wrapping ${toolType} ${toolPath} into skill ${skillName}...`); // Create directory structure fs.mkdirSync(skillDir, { recursive: true }); fs.mkdirSync(path.join(skillDir, 'references'), { recursive: true }); fs.mkdirSync(path.join(skillDir, 'assets'), { recursive: true }); fs.mkdirSync(path.join(skillDir, 'scripts'), { recursive: true }); fs.mkdirSync(path.join(skillDir, 'hooks'), { recursive: true }); // Create wrapper script const wrapperScript = `#!/bin/bash # Wrapper script for ${skillName} # This script wraps the original ${toolType}: ${toolPath} ${toolPath} "$@" `; fs.writeFileSync(path.join(skillDir, 'scripts', 'wrapper.sh'), wrapperScript); // Make wrapper script executable if (process.platform !== 'win32') { try { fs.chmodSync(path.join(skillDir, 'scripts', 'wrapper.sh'), 0o755); } catch (error) { console.log('Note: Could not set executable permissions (Windows)'); } } ``` ### Technical Analysis The value supplied through `--script` or `--binary` is checked only for filesystem existence. It is then inserted verbatim into an executable ...[truncated 1474 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (23)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

md
| `SKILL.md` | Main documentation and usage guide | ✅ Yes |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.

md
| `SKILL.md` | Main documentation and usage guide | ✅ Yes |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 378)May include surrounding context.

md
| `SKILL.md` | Main documentation and usage guide | ✅ Yes |

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 335)May include surrounding context.

md
#    and provides recommendations based on best practices

# 3. Implement features with guidance from research
# (edit SKILL.md and other files)

# 4. Test and refine
skill-forge check my-excel-skill

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 455)May include surrounding context.

md
dist/

# Environment variables
.env
.env.local

# IDE files

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 456)May include surrounding context.

md
# Environment variables
.env
.env.local

# IDE files
.vscode/

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/examples.md (reported line 102)May include surrounding context.

Initialize with browser template

skill-creator init web-scraper --template=browser

Edit SKILL.md to add specific functionality

Add browser commands and examples

text

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · scripts/skill-creator.js (reported line 200)May include surrounding context.

js
console.log(`Created directory structure at: ${skillDir}`);
  console.log('Next steps:');
  console.log('1. Edit _meta.json with your skill details');
  console.log('2. Update SKILL.md with documentation');
  console.log('3. Run: skill-creator check', skillName, 'to verify structure');
}

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · scripts/skill-creator.js (reported line 1037)May include surrounding context.

js
console.log(`Created directory structure at: ${skillDir}`);
  console.log('Next steps:');
  console.log('1. Edit _meta.json with your skill details');
  console.log('2. Update SKILL.md with documentation');
  console.log('3. Run: skill-creator check', skillName, 'to verify structure');
}

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README advertises automatic project research, multi-search engine integration, and browser automation, but does not warn users that prompts, queries, or repository data may be transmitted to external services. This creates a real privacy and security risk because operators may use the skill with sensitive code, internal project names, or credentials without understanding that data could leave the local environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly describes automatic searches of GitHub/ClawHub, analysis of external projects, and security scanning of referenced code, but does not warn users that prompts, repository identifiers, or related context may be sent to third-party services. In an agent skill context, silent outbound discovery and analysis can leak sensitive project intent, internal names, or code references and may violate privacy or network-boundary expectations.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/examples.md (reported line 8)May include surrounding context.

Step 1: Initialize

bash
# Create a new skill
skill-creator init my-first-skill

# With template

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The top-level documentation presents this as a command-line tool for creating skills, which implies scaffolding and validation. However, the code also performs system-level package installation via package managers and installs files into an OpenClaw skills directory, which goes beyond simple skill creation behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

Automatic dependency installation modifies the host system without an interactive confirmation, dry-run preview, or safety warning. In this codebase that is especially risky because installation targets come from skill metadata and execution may invoke privileged package managers, amplifying accidental or malicious system changes.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The tool installs arbitrary system packages derived from _meta.json using shell commands such as winget, brew, and sudo apt-get. Because dependency names are external input and are interpolated into execSync command strings without validation, this creates both an overbroad system-modification capability and a command-injection risk with potentially privileged execution on Linux.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
98% confidence
Finding

The Linux installation branch invokes sudo apt-get install -y, introducing privileged system modification from within the CLI. In combination with metadata-driven package names and shell interpolation, this can lead to privileged command execution or unauthorized package installation if the input is malicious or mistaken.

Content

Scanner excerpt · scripts/skill-creator.js (reported line 371)May include surrounding context.

js
execSync(`brew install ${dependency}`, { stdio: 'ignore' });
    } else {
      // Linux - try apt
      execSync(`sudo apt-get install -y ${dependency}`, { stdio: 'ignore' });
    }
    return true;
  } catch (error) {

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The OpenClaw install path copies files into a trusted directory under the user's home folder without prior confirmation. That can unexpectedly persist code or configuration where the agent platform may later load it, increasing the risk of silent deployment of unsafe skills.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The install path copies a supplied skill directory into a user-specific OpenClaw skills folder, which is a persistence/deployment action. Since the destination is under the user's home directory and the copy is performed automatically, a user can unknowingly deploy unreviewed or malicious skill content into a location likely to be trusted by the platform.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

Wrapper generation writes an executable shell script that directly invokes a user-supplied tool path, embedding that path unescaped into shell content. If the supplied path contains shell metacharacters or command substitutions, the generated wrapper can execute unintended commands when run, turning a convenience feature into a code-execution primitive.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

This markdown file contains a full second changelog section in Chinese, but it does not explain that the document is multilingual or offer a language choice. Under the policy rule for language/locale, forcing or implicitly preferring a specific language without opt-in can be a natural-language policy concern.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

This is a manifest file, so vague-trigger review applies. The description says the skill is a "powerful tool" with "intelligent guidance" for "forging high-quality skills," but provides no concrete invocation phrases, context limits, or exclusion conditions, which could make activation matching overly broad in systems that rely on manifest descriptions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The package command creates a new archive file via Compress-Archive, which writes data to disk, but there is no prior warning or confirmation before doing so. The success message appears only after the write, so users are not informed in advance that a new file will be created in the current location.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The help output enumerates the supported commands, but it does not include the implemented search/analyze/detect-malware functions elsewhere in the file. This creates a mismatch between the documented CLI surface and the actual code capabilities, especially for project inspection and malware scanning behaviors.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/skill-creator.js:299

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
scripts/skill-creator.js:612

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/skill-creator.js:733