ClawHub
Back to skill

Security audit

Skill Reviewer

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent skill-review guide, but it tells agents to install other skills through an unpinned npx command that can execute mutable third-party code.

Install only if you are comfortable with a Chinese-language skill reviewer that may prompt agents to inspect target skill folders. Do not let it run the `npx molthub@latest install skill-name` workflow on your normal machine; provide a local skill folder or run any package installation in a disposable sandbox with a pinned, verified version.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:477
Finding

Unpinned Third-Party Package Download and Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 477
Vulnerability Type: Supply-chain risk through an unpinned npm package
Risk Level: Medium

Vulnerable Code

bash
npx molthub@latest install skill-name

Technical Analysis

The Skill instructs the agent to use npx with the mutable @latest tag. If the package is not already cached locally, npx may retrieve it from the configured npm registry and immediately execute its CLI code. The command does not pin an audited version, verify package integrity or provenance, validate the publisher, or require execution in a sandbox.

Because latest can point to different package contents after this Skill has been reviewed, the effective executable payload is not fixed. A compromised maintainer account, registry compromise, malicious package update, or package ownership transfer could therefore introduce arbitrary code without any change to this repository.

Installing another Skill is not necessary when the reviewer is given an existing local folder. Consequently, automatic third-party package execution exceeds the minimum privileges required for the declared static review functionality.

Attack Path

  1. An attacker compromises the molthub package, its publisher account, or the package release process.
  2. The attacker publishes a malicious version and causes the npm latest tag to resolve to it.
  3. A user asks the Skill to review another Skill that is not already available locally.
  4. The agent follows the documented workflow and executes:
    bash
    npx molthub@latest install skill-name
  5. npx downloads and runs the remotely supplied package code.
  6. The malicious code executes with the operating-system privileges and environment available to the agent process.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the invoking user's account. Depending on the runtime environment, the package could read or modify project file ...[truncated 362 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove automatic installation from the review workflow. Require users to supply a local Skill folder or archive for static inspection.
  2. If package use is essential, pin a specifically reviewed version rather than using @latest, for example molthub@X.Y.Z.
  3. Verify the package name, publisher, provenance, lockfile metadata, and registry integrity hash before execution.
  4. Download and inspect the package separately before running any code. Do not combine retrieval and execution in one command.
  5. Disable dependency lifecycle scripts where supported and applicable.
  6. Run the tool inside a disposable sandbox or container with:
    • No host credentials or secrets
    • Read-only access to source material where practical
    • A dedicated temporary output directory
    • Restricted network access
    • No access to SSH agents, home-directory credentials, or unrelated repositories
  7. Document the network and execution requirement explicitly in Skill compatibility metadata if this behavior is retained.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (14)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md
> 示例：`ls skills/my-skill/` 检查 `SKILL.md` 是否存在

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The description says to use this skill when the user says phrases like "检查 skill", "审核 skill", "skill 写得怎么样", and especially "帮我看看这个 skill 有什么问题". These are broad natural-language requests without clear scope limits or exclusion conditions, which could cause unintended invocation whenever a user casually asks for feedback on a skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The manifest description is entirely in Chinese and specifies Chinese trigger phrases for invocation, but it does not state that the skill is China-specific or offer language choice. This creates a natural-language locale constraint that may exclude users or force a language without opt-in.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 102)May include surrounding context.

示例：验证 YAML 前置信息

bash
# 读取前 20 行检查 YAML
head -20 skills/china-holidays/SKILL.md

预期输出（正确示例）：

yaml

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 516)May include surrounding context.

示例：验证 YAML 前置信息

bash
# 读取前 20 行检查 YAML
head -20 skills/china-holidays/SKILL.md

预期输出（正确示例）：

yaml

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 423)May include surrounding context.

bash
# 1. 验证 YAML 前置信息
head -20 skills/my-skill/SKILL.md
# 目视确认 YAML 有效

# 2. 统计代码块数量

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 427)May include surrounding context.

bash
# 1. 验证 YAML 前置信息
head -20 skills/my-skill/SKILL.md
# 目视确认 YAML 有效

# 2. 统计代码块数量

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 431)May include surrounding context.

bash
# 1. 验证 YAML 前置信息
head -20 skills/my-skill/SKILL.md
# 目视确认 YAML 有效

# 2. 统计代码块数量

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 434)May include surrounding context.

bash
# 1. 验证 YAML 前置信息
head -20 skills/my-skill/SKILL.md
# 目视确认 YAML 有效

# 2. 统计代码块数量

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The skill instructs users to run npx molthub@latest install skill-name, which fetches and executes the latest published package version without pinning. This creates a supply-chain risk: if the package is compromised or a breaking/malicious release is published, users following the skill may execute attacker-controlled code.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 480)May include surrounding context.

md
npx molthub@latest install skill-name

# 阅读内容
cat skills/skill-name/SKILL.md

# 运行快速审核模板
# 如分数 < 25，考虑卸载并寻找替代

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

该文件标题和开头明确表明这是官方指南的全文中文译版，但全文未说明这是可选语言版本，也未为用户提供语言/locale 选择。对于通用技能开发指南，这种默认强制单一语言的呈现可能构成未征得用户同意的语言策略限制。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

该文件标题直接表明是中文版本，且通篇指令、示例与输出约定均以中文固定呈现，没有说明这是可选本地化版本，也未提供语言切换或用户偏好选择。根据语言/地区策略，若技能材料强制单一语言而无用户选择或明确合理限定，可构成自然语言政策问题。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

The checklist gives English-only examples ("You might...") as discouraged phrasing while the rest of the document is in Chinese, implicitly prescribing a language style without offering a user or locale choice. This can be interpreted as a locale/language policy issue because it nudges authors toward a specific language norm rather than making language selection explicit.

Content

No source excerpt is available for this finding.