ClawHub
Back to skill

Security audit

risk-skill

Security checks for vulnerabilities and agentic risk

Overview

This is a simple local risk-assessment helper with no hidden data access, persistence, network use, or destructive behavior, though its advice should not be treated as authoritative for business decisions.

Installers should treat the outputs as lightweight advisory examples, not professional financial, compliance, or operational risk determinations. If using the publishing commands, prefer a trusted or pinned ClawHub CLI version rather than running an unpinned `npx` command.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding
The documentation instructs users to run `npx clawhub login`, which fetches and executes the latest published package version at runtime without pinning. If the upstream package, dependency chain, or registry resolution is compromised, users could execute unintended code on their systems during login.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding
The publish command uses `npx clawhub publish` without an explicit version, causing execution of whatever version resolves at the time the command is run. In a supply-chain compromise scenario, this could lead to arbitrary code execution in the publisher's environment and exposure of local source, credentials, or release artifacts.

Vague Triggers

Medium
Confidence
92% confidence
Finding
The skill description is very broad ('identify, assess, and manage various types of risks') and the manifest provides no trigger scope, domain boundaries, or activation constraints. In agent ecosystems, this can cause over-invocation, misuse outside intended contexts, or excessive trust in outputs for high-stakes risk decisions, even if the file does not contain obviously malicious behavior.

Natural-Language Policy Violations

Low
Confidence
78% confidence
Finding
This Python skill is in scope for natural-language policy review. The user-facing metadata, docstrings, status values, and recommendations are all hard-coded in English, and the file provides no opt-in or mechanism for alternate language/locale selection.

Static analysis

No suspicious patterns detected.