ClawHub
Back to skill

Security audit

Test Import

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says by publishing local skill files to ClawHub, but it ships a hardcoded publishing token and uploads selected local files without strong user review controls.

Review the target directory carefully before using this skill, because it uploads matching source and text files to ClawHub and may publish them publicly or under the configured account. Do not install or run this version with the embedded token present; the publisher should revoke that token and replace it with user-provided credentials plus a dry-run or confirmation step.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
publish.py:11
Finding

Hardcoded ClawHub Bearer Token Exposes Publishing Credentials

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill explicitly instructs users to publish a local skill directory to an external service, but the documentation does not warn that local contents will be transmitted or encourage users to review included files first. In a skill-publishing context, this can lead to accidental disclosure of secrets, private prompts, test data, or other sensitive files bundled in the target directory.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The natural-language instructions and examples are presented in Chinese, including parameter examples and descriptive text, with no indication that the user may choose another language or that the skill is intentionally region-specific. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · publish.py (reported line 17)May include surrounding context.

python
def upload_file(filename, content_type="text/plain"):
    """获取上传URL并上传文件"""
    resp = requests.post(
        "https://clawhub.ai/api/cli/upload-url",
        headers={"Authorization": f"Bearer {TOKEN}"},
        json={"filename": filename, "contentType": content_type}

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · publish.py (reported line 17)May include surrounding context.

python
def upload_file(filename, content_type="text/plain"):
    """获取上传URL并上传文件"""
    resp = requests.post(
        "https://clawhub.ai/api/cli/upload-url",
        headers={"Authorization": f"Bearer {TOKEN}"},
        json={"filename": filename, "contentType": content_type}

Tainted flow: 'upload_url' from requests.post (line 23, network input) → requests.put (network output)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · publish.py (reported line 27)May include surrounding context.

python
if upload_url:
        # 上传文件内容
        requests.put(upload_url, data=content, headers={"Content-Type": content_type})
    
    return True

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script reads local files from the provided skill directory and uploads them to a remote service without any explicit user-facing warning about what content will leave the machine. In a skill/publishing context, this can lead to unintended disclosure of source code, embedded secrets, or sensitive documentation if users point the tool at the wrong directory or do not understand that all matching files are transmitted.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The comment on L06 is written only in Chinese, which reflects a language-specific instruction in the file without offering any language choice or justification. The policy explicitly calls for flagging language or locale constraints when they force a specific language without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The reasoning field and duplicated raw_prediction.reasoning text are written only in Chinese, with no indication that language choice is optional or that the skill is region-specific. This can violate a language/locale policy when a skill or its metadata implicitly enforces one language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The file's human-facing description and CLI help text are written in Chinese, which imposes a specific language on users of the skill without any opt-in or explanation that the tool is intended only for a Chinese-speaking audience. This matches the policy category for language or locale constraints expressed in natural-language content.

Content

No source excerpt is available for this finding.