ClawHub
Back to skill

Security audit

Skill Factory

Security checks for vulnerabilities and agentic risk

Overview

The skill is broadly aligned with building and publishing OpenClaw skills, but its publish path has high-impact safety issues that deserve review before installation.

Review this skill before installing or running publish. It is not artifact-backed malicious, but only use it in a controlled workspace, publish only skills you have reviewed, avoid untrusted .learnings entries, and prefer a fixed trusted ClawHub CLI version until the shell execution and confirmation issues are addressed.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/factory.js:123
Finding

Arbitrary Command Execution Through Shell Injection in the Publish Command

Content
View full analysis
Remediation
View remediation
', 'publish', resolvedDir, '--slug', slug, '--name', name, '--version', '1.0.0', '--tags', 'latest,agents', ], { encoding: 'utf8', cwd: WORKSPACE, timeout: 30000 } ); ``` Using argument arrays prevents shell interpretation, although dependency pinning should also be addressed separately. ]]>

T08 · Insecure Dependencies

Error
Location
scripts/factory.js:142
Finding

Execution of an Unpinned Mutable npm Package During Publication

Content
View full analysis
Remediation
View remediation

T01 · Skill Instruction Hijacking

Error
Location
scripts/factory.js:239
Finding

Indirect Prompt Injection Through Untrusted Learning Entries

Content
View full analysis
.js CONSTRAINTS: - SKILL.md under 200 lines - Script under 300 lines - CLI interface with --help - Exit codes: 0=success, 1=problem, 2=error - Store data in ./ directory (relative to cwd) `; // Write the prompt so the LLM can read it const promptPath = path.join(skillDir, '.factory-prompt.md'); fs.writeFileSync(promptPath, prompt); ``` The `from-error` command passes data parsed from `.learnings` into that prompt: ```js const slug = slugify(entry.title); console.log(`Building skill from: [${entry.id}] ${entry.title}`); console.log(`Fix: ${entry.fix}`); scaffold(slug, `${entry.title}. Known fix: ${entry.fix}`); ``` ### Technical Analysis Titles and fixes from `.learnings/ERRORS.md` or `.learnings/LEARNINGS.md` are treated as trusted instructions and interpolated verbatim into `.factory-prompt.md`. The generated file is explicitly intended to be read and followed by an LLM. Quotation marks around `${description}` provide no semantic isolation for an LLM. An attacker-controlled entry can contain text instructing the model to disregard surrounding constraints, create unrelated files, generate unsafe scripts, expose information, or otherwise alter the intended skill-generation task. There is no explicit ...[truncated 1869 chars]
Remediation
View remediation
{structured and escaped learning data} ``` This separation reduces risk but does not replace human review, because prompt-level delimiters cannot provide a complete security boundary. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md
## Why This Exists

Building skills manually takes 30 minutes: write SKILL.md, write the script, test, package, publish. The factory cuts this to 10 minutes by structuring the workflow and automating the boring parts.

More importantly: it connects to your `.learnings/` error log. When a problem recurs 3+ times, the factory flags it as a skill candidate. Your mistakes become products.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md
node scripts/factory.js scan

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md
node scripts/factory.js scan

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

md
node scripts/factory.js scan

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

md
node scripts/factory.js scan

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

md
node scripts/factory.js scan

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

The Pipeline

text
Mistake → .learnings/ERRORS.md → scan (3+ recurrences) → from-error → write skill → publish

Learnings Format

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · scripts/factory.js (reported line 122)May include surrounding context.

js
console.log(`SCAFFOLD CREATED: ${skillDir}`);
  console.log(`\nNext steps:`);
  console.log(`1. Read ${promptPath}`);
  console.log(`2. Write SKILL.md and scripts based on the prompt`);
  console.log(`3. Test the script`);
  console.log(`4. Run: node factory.js publish ${skillDir}`);

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding

The skill describes actions that read workspace files, build artifacts, publish packages, and rely on environment-backed authentication, but it does not declare any explicit tool or permission scope. That mismatch makes the skill harder to sandbox and review, and can lead to overbroad execution in hosts that infer capabilities from the content rather than an explicit allowlist.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

Using npx clawhub@latest login pulls the latest remote package at runtime, which is a classic supply-chain risk because the executed code can change without review. In a skill that handles authentication and later publishing, compromise of that dependency could expose credentials or publish malicious content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The publish flow performs both local packaging and an external network publication, but the script does not present a clear confirmation or warning immediately before those sensitive actions. In an agent-oriented skill, this increases the chance of unintended code distribution or data egress because the command looks like a normal build step while actually initiating outbound publication.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The script executes npx clawhub@latest publish, which fetches and runs the latest remote package version at publish time. That creates a supply-chain risk: a compromised or malicious upstream release could execute arbitrary code in the user's environment during packaging/publishing, and this skill's purpose makes that path routine rather than exceptional.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/factory.js:154