ClawHub
Back to skill

Security audit

Skill Publish Vetter

Security checks for vulnerabilities and agentic risk

Overview

This publishing helper has a useful privacy purpose, but it can print detected secret values into chat and logs.

Review before installing or using this skill. Its goal is protective, and it does require confirmation before publishing, but its scan report can expose secrets by copying matched values into terminal output and chat. Use only on directories you are comfortable having scanned, and prefer a revised version that redacts all credential values before reporting.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/publish-check.sh:82
Finding

Sensitive credentials are reproduced in terminal and chat scan reports

Content
View full analysis
/dev/null || true) ``` `scripts/publish-check.sh:89-97`: ```bash if echo "$file_base" | grep -qi '\.env'; then while IFS= read -r line; do [ -z "$line" ] && continue [[ "$line" =~ ^[[:space:]]*# ]] && continue [[ "$line" =~ ^[[:space:]]*$ ]] && continue is_placeholder "$line" && continue log_finding "CRITICAL" ".env Actual Value" "$file_base" "N" ".env contains actual value: $(echo "$line" | head -c 80)" "Delete .env or replace all values with placeholders" done < "$file" fi ``` `scripts/publish-check.sh:104-112`: ```bash while IFS= read -r match; do [ -z "$match" ] && continue local line_num="${match%%:*}" local content="${match#*:}" is_placeholder "$content" && continue log_finding "CRITICAL" "Hardcoded Bearer Token" "$file_base" "$line_num" "Hardcoded Bearer token: $(echo "$content" | head -c 80)" "Use environment variable or placeholder" done < <(grep -nE 'Authorization:[[:space:]]*Bearer[[:space:]]+[A-Za-z0-9_./+-]{8,}' "$file" 2>/dev/null || true) ``` `SKILL.md:65-67`: ```markdown ### Step 3: Output the Full Report **Output the complete scan report to the chat.** Do not summarize or omit anything. ``` ### Technical Analysis The scanner places matching password ...[truncated 2900 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md
---
name: skill-publish-vetter
version: 1.1.0
description: Pre-publish privacy scan for ClawHub skills. Detects tokens, keys, credentials, .env secrets, personal info, and internal IPs before publishing.
---

# Skill Publish Vetter 🛡️

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/publish-check.sh (reported line 91)May include surrounding context.

sh
---
name: skill-publish-vetter
version: 1.1.0
description: Pre-publish privacy scan for ClawHub skills. Detects tokens, keys, credentials, .env secrets, personal info, and internal IPs before publishing.
---

# Skill Publish Vetter 🛡️

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

md
- User says "publish skill to ClawHub"
- User says "upload skill to ClawHub"
- User says "update skill on ClawHub"
- Any request to submit a skill to a public registry

---

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

md
| **`.env` Values** | `.env` files with actual (non-placeholder) assignments | `.env: DB_PASS=real_password` |
| **Hardcoded Creds** | `Authorization: Bearer` with real tokens | `curl -H "Authorization: Bearer sk-xxx"` |
| **Personal Emails** | Non-placeholder, non-org emails | `zhangsan@gmail.com` |
| **Personal Paths** | `/home/username/`, `/Users/username/` absolute paths | `/Users/weidongkl/.ssh/id_rsa` |
| **Internal IPs** | `192.168.x.x`, `10.x.x.x`, `172.16-31.x.x` | `https://192.168.1.100:8080` |

### Step 3: Output the Full Report

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.

md
If any of these are found, **refuse to publish by default**:

1. Any token with actual values (Bearer tokens, API keys, Access tokens)
2. Any private key content (PEM format, SSH private keys)
3. Any password/credential with actual values (not placeholders)
4. `.env` files with actual configuration values

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/publish-check.sh (reported line 53)May include surrounding context.

sh
-name "*.md" -o -name "*.txt" -o -name "*.sh" -o -name "*.py" -o \
    -name "*.js" -o -name "*.ts" -o -name "*.json" -o -name "*.yaml" -o \
    -name "*.yml" -o -name "*.toml" -o -name "*.ini" -o -name "*.cfg" -o \
    -name "*.conf" -o -name "*.env" -o -name "*.spec" -o -name "*.ks" -o \
    -name "Makefile" -o -name "Dockerfile" -o \
    -name "*.html" -o -name "*.css" -o -name "*.xml" \
  \) -print0 2>/dev/null)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/publish-check.sh (reported line 92)May include surrounding context.

sh
done < <(grep -nE 'BEGIN.*PRIVATE KEY' "$file" 2>/dev/null || true)

    # === .env actual values ===
    if echo "$file_base" | grep -qi '\.env'; then
      while IFS= read -r line; do
        [ -z "$line" ] && continue
        [[ "$line" =~ ^[[:space:]]*# ]] && continue

Credential Access

High
Category
Privilege Escalation
Confidence
89% confidence
Finding

This line logs the beginning of each non-placeholder .env entry directly into the results file and later prints it in the report. Even though the skill is intended to detect secrets, echoing actual .env values can leak credentials into terminal history, CI logs, screenshots, or other monitoring systems, turning a protective scan into an exposure path.

Content

Scanner excerpt · scripts/publish-check.sh (reported line 98)May include surrounding context.

sh
[[ "$line" =~ ^[[:space:]]*# ]] && continue
        [[ "$line" =~ ^[[:space:]]*$ ]] && continue
        is_placeholder "$line" && continue
        log_finding "CRITICAL" ".env Actual Value" "$file_base" "N" ".env contains actual value: $(echo "$line" | head -c 80)" "Delete .env or replace all values with placeholders"
      done < "$file"
    fi

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Line L020 says the skill applies to "Any request to submit a skill to a public registry," which is broader than the rest of the document's ClawHub-specific scope. This can cause unintended invocation for unrelated registries or workflows because it does not clearly bound when this skill should or should not activate.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

md
- "cancel" / "no" / "stop" → abort. Do nothing.
- No response → do not publish. Wait.

**Never skip confirmation. Never auto-publish.**

### Step 6: Publish

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 169)May include surrounding context.

md
---

*Safety first, publishing second. Never publish without confirmation.* 🛡️

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

This code file performs a privacy scan over many file types and later includes snippets of matching content in its output, which means it can access and display secrets or personal data from the target directory. Although the header says it scans for leaked secrets, there is no clear user-facing warning near execution that the script will read files recursively and may print sensitive matches to stdout.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.