ClawHub
Back to skill

Security audit

Skill Updater

Security checks for vulnerabilities and agentic risk

Overview

This looks like a legitimate skill updater, but it can broadly change installed agent skills and replace local skill folders without enough user-controlled scoping.

Install only if you want an agent-accessible tool that can inspect and update local skills. Prefer running check first, use --path and --source to limit scope, review repositories and lockfile sources before updating, and avoid broad global updates unless you are comfortable changing future agent behavior across multiple environments.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
if repo_dir.exists():
        run_git(repo_dir, ["fetch", "--tags", "--prune", "origin"])
        return repo_dir
    subprocess.run(
        ["git", "clone", "--depth=1", source_url, str(repo_dir)],
        check=True,
        text=True,
Confidence
89% confidence
Finding
The code performs 'git clone' on a source URL taken from lockfile/provider data without validating the protocol or constraining git's behavior. A malicious source URL can cause connections to attacker-controlled endpoints, including local-network or local-file style transports, creating SSRF-style reachability, unintended local access, and execution of risky git transport behaviors during update checks.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The trigger phrases are broad, common requests such as checking or updating skills, viewing global skill status, or showing only risky items. Broad invocation language can cause the skill to activate unexpectedly in normal conversation, which is especially risky here because the skill appears capable of scanning global directories and performing updates via shell/file operations.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The update path removes the existing local skill directory with 'shutil.rmtree(local_skill)' and replaces it from remote content automatically, with no interactive confirmation and no rollback verification beyond a backup archive path. In this skill's context, that means untrusted remote repository state can overwrite executable skill content and destroy local customizations, which is a material integrity risk.

Static analysis

No suspicious patterns detected.