Skill Trust Guard

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:49 PM UTC
• Version: 1.0.0

Overview

This skill is a coherent security wrapper, but it can replace the user's clawhub command path and run risky install/delete flows before or outside the scan it claims to enforce.

Review this carefully before installing. It is not clearly malicious, but it modifies the command path for clawhub and performs broad install and deletion operations. Only use it in a controlled environment after fixing artifact identity binding, removing unpinned npx execution, adding strict destination path validation, and providing a safe shim uninstall or repair path.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T08 · Insecure Dependencies

Error

• Location: hooks/pre-install.sh:7

Finding

Unpinned dependency execution through npx weakens the security gate

Content

View full analysis

/dev/null || true) ``` ### Technical Analysis The security hook executes `tsx` through `npx` without referencing a pinned, integrity-verified local executable. If `tsx` is unavailable locally, `npx` may resolve and download the package from the configured package registry. Consequently, code that was not included in or reviewed with this project can execute during every security scan. The scanner root and CLI path are also environment-overridable. Although configurability may be intentional, the hook does not authenticate the selected scanner or ensure that it is a trusted installation. Because this dependency runs inside the security decision path, compromise or unexpected package resolution can both execute arbitrary code and forge the score used to approve an installation. ### Attack Path 1. The user invokes `install.sh`, which calls `hooks/pre-install.sh`. 2. The local environment does not contain a trusted `tsx` executable, or dependency resolution is influenced by a compromised registry or configuration. 3. `npx` obtains and executes an unpinned package. 4. Package initialization or executable code runs with the invoking user's privileges. 5. The malicious dependency can access user-readable files, alter scanner output, or return an artificial passing score. 6. The guard installs a target that did not receive a trustworthy scan. A local process capable of controlling the invocation environment could also set `SCANNER_ROOT` or `SCANNER_CLI` to attacker-controlled scanner code. ### Impact Assessment Successful exploitation permits arbitrary ...[truncated 325 chars]

Remediation

View remediation

&2 exit 30 } RAW=$(cd "$SCANNER_ROOT" && "$TSX_BIN" "$SCANNER_CLI" "$SKILL_PATH" --json) ``` 4. Use lockfile integrity metadata and an approved registry. 5. Canonicalize and validate `SCANNER_ROOT` and `SCANNER_CLI`. 6. If environment overrides must remain supported, document that they are trust-boundary inputs and reject paths that are writable by untrusted users. 7. Preserve the scanner's actual exit status instead of suppressing it with `|| true`; fail closed when scanner execution fails. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: install.sh:85

Finding

Registry content is fetched again after scanning, allowing a scan-to-install TOCTOU bypass

Content

View full analysis

/tmp/skill-trust-guard.install.log 2>&1; then err "Failed to fetch from clawhub. See /tmp/skill-trust-guard.install.log" exit 1 fi SCAN_PATH="$TMPDIR/$TARGET" fi ``` ```bash if [[ "$ORIGIN" == "clawhub" ]]; then log "Installing from clawhub..." clawhub "${GLOBAL_OPTS[@]}" install "$TARGET" "${INSTALL_OPTS[@]}" else ``` ### Technical Analysis For a registry target, the wrapper first runs `clawhub install` into a temporary directory and scans the resulting files. After approval, it independently runs `clawhub install` again against the registry. No digest, immutable artifact identifier, resolved version, or content comparison binds the second download to the staged artifact. The files approved by the scanner therefore need not be the files ultimately installed. This is a time-of-check to time-of-use flaw in the project's central security boundary. Normal registry mutation, a compromised registry, malicious publisher timing, or inconsistent mirrors could cause different content to be returned by the two requests. ### Attack Path 1. An attacker publishes or controls a mutable registry target. 2. The first `clawhub install` request returns benign content. 3. The scanner gives the staged content an acceptable score. 4. Before the second request, the attacker changes the target content, mutable tag, or registry response. 5. The second `clawhub install` retrieves the changed artifact. 6. The unscanned artifact is installed into the user's actual destination. ### Impact Assessment Exploitation bypasses the guard's security decision and installs arbitrary unscanned Skill c ...[truncated 282 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: install.sh:72

Finding

Unchecked installation name can make recursive deletion target the entire destination directory

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: install.sh:78

Finding

Predictable log files in shared temporary storage permit symlink-based file clobbering

Content

View full analysis

/tmp/skill-trust-guard.git.log 2>&1 || { err "Git clone failed. See /tmp/skill-trust-guard.git.log"; exit 1; } SCAN_PATH="$TMPDIR/source" fi if [[ "$ORIGIN" == "clawhub" ]]; then log "Fetching skill for scan: $TARGET" if ! clawhub "${GLOBAL_OPTS[@]}" --dir "$TMPDIR" install "$TARGET" "${INSTALL_OPTS[@]}" --force >/tmp/skill-trust-guard.install.log 2>&1; then err "Failed to fetch from clawhub. See /tmp/skill-trust-guard.install.log" ``` ### Technical Analysis The script redirects command output to fixed, predictable paths in the shared `/tmp` directory. Shell redirection follows symbolic links and truncates the destination before executing the command. A local attacker who can create files in `/tmp` can pre-create either log path as a symbolic link to another file writable by the victim. When the victim runs the guard, the linked file may be truncated or overwritten. The project already creates a unique temporary directory through `mktemp -d`, so the shared fixed log paths are unnecessary. Concurrent guard executions also overwrite one another's diagnostics. ### Attack Path 1. A local attacker predicts `/tmp/skill-trust-guard.git.log` or `/tmp/skill-trust-guard.install.log`. 2. The attacker creates that path as a symbolic link to a file writable by the victim. 3. The victim runs the guard using a Git or registry target. 4. Shell redirection follows the symbolic link. 5. The linked file is truncated and receives command output. ### Impact Assessment Exploitation can corrupt or overwrite files writable by the victim account. It does not allow modification of files that the victim could not already write. If the script is run with elevated privileges, the affected scope c ...[truncated 134 chars]

Remediation

View remediation

T07 · Tool Hijacking and Spoofing

Warning

• Location: integrate.sh:4

Finding

Repeated integration can produce a self-referential clawhub shim

Content

View full analysis

&2 exit 1 fi mkdir -p "$SHIM_DIR" cat > "$SHIM_DIR/clawhub" <

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md

- `hooks/pre-install.sh`：可复用 pre-install hook（本地路径扫描 + 决策）

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script claims to be a security wrapper, but for clawhub sources it first runs clawhub ... install ... --force into a temporary directory before performing the security scan. If clawhub install executes hooks, performs extraction with side effects, or otherwise processes untrusted content during install, malicious code may run before the scan can block it, defeating the wrapper's security promise.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

The script performs rm -rf "$TARGET_DIR/$INSTALL_NAME" where TARGET_DIR may come from user-supplied --dir input and INSTALL_NAME is derived from the target. Although quoting prevents shell injection, this still enables destructive deletion of an attacker-chosen or mistakenly chosen path under a user-controlled base directory, which can remove arbitrary directories the user has permission to delete.

Content

Scanner excerpt · install.sh (reported line 141)May include surrounding context.

sh

if [[ "${GLOBAL_OPTS[$i]}" == "--dir" ]]; then TARGET_DIR="${GLOBAL_OPTS[$((i+1))]}"; fi
  done
  mkdir -p "$TARGET_DIR"
  rm -rf "$TARGET_DIR/$INSTALL_NAME"
  cp -R "$SCAN_PATH" "$TARGET_DIR/$INSTALL_NAME"
  ok "Copied skill to $TARGET_DIR/$INSTALL_NAME"
fi

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Line L03 presents the skill description entirely in Chinese, while the rest of the document is mixed-language and there is no indication that the skill is intended only for Chinese-speaking users. The stated policy flags language or locale constraints unless the skill offers user choice or clearly documents a justified regional scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The user-facing natural-language content in this skill file is entirely in Chinese, and there is no indication that the skill is region-specific or that users can opt into another language. This creates a language/locale policy concern because it implicitly restricts usability and instructions to a single language without documented justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This markdown file presents all substantive testing notes in Chinese and does not indicate that another language is available or that the language choice is optional. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The script invokes npx tsx without pinning an exact package version, so execution can resolve to whatever tsx version is available in the environment or fetched at install time. In a pre-install security gate, this is especially dangerous because a compromised or unexpected package version could run arbitrary code before the skill is approved, undermining the trust check itself.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · install.sh (reported line 21)May include surrounding context.

sh

Policy:
  score < 50     -> block
  50 <= score <75 -> warn + ask (or auto-approve with --yes)
  score >= 75    -> allow
EOF
}

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · install.sh (reported line 126)May include surrounding context.

sh

*) err "Installation aborted by user"; exit 1 ;;
    esac
  else
    warn "Auto-approved due to --yes"
  fi
else
  ok "Score >= 75, proceeding"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

For local and git installs, the script unconditionally deletes any existing destination directory with rm -rf before copying the new skill, without warning or confirmation. This can cause irreversible loss of an existing skill installation or user modifications, especially when combined with a user-controlled install target directory.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file contains user-facing natural language that assumes Chinese as the required language for the skill report. Under the policy rule, forcing a specific language without user opt-in can be a locale/language policy violation unless the constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.