ClawHub
Back to skill

Security audit

skillguard-check

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says: checks installed skill names against skillguard.vip, with some privacy and installation caveats users should understand.

Before installing, understand that the skill will list local skill directory names and send each name to skillguard.vip for lookup. Prefer installing from a reviewed ClawHub package or a pinned, verified commit rather than the README's mutable main-branch curl or sparse-clone commands. Use explicit checks rather than broad automatic or periodic invocation if local skill names are sensitive.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning
Location
README.md:29
Finding

Mutable Remote Executable Installed Without Integrity Verification

Content
View full analysis
Remediation
View remediation
/skills/skillguard-check/scripts/check.py ``` 2. Publish versioned, immutable releases and direct users to a specific release artifact. 3. Publish SHA-256 checksums through a separately protected release channel and require verification before installation or execution: ```bash echo " check.py" | sha256sum --check - ``` 4. Prefer cryptographically signed release artifacts or signed Git tags, and document signature verification. 5. Update the sparse-clone method to check out a specific commit or verified signed tag rather than the current default branch. 6. Download into a temporary location, verify integrity and provenance, and only then move the files into the trusted Skill directory. 7. Avoid automatically executing newly downloaded Skill code until its version and integrity have been verified. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (11)

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · README.md (reported line 28)May include surrounding context.

cd skillguard-check-tmp git sparse-checkout set skills/skillguard-check mv skills/skillguard-check ../skillguard-check cd .. && rm -rf skillguard-check-tmp

text

Or just copy the files directly:

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The overall purpose matches closely: the script enumerates locally installed skills and checks them against skillguard.vip, with no evident unrelated or hidden behavior. However, there is a material behavior mismatch in how 'high-risk' is determined. The description says high-risk skills are those with score < 50, but the code classifies high risk solely from the audit field riskLevel being 'high' or 'critical'. It never applies a numeric score threshold, even though it includes score in output and sorting. As a result, some skills with score under 50 could be labeled medium or safe, and the exit code logic would also miss them unless riskLevel is high/critical. This makes the description inaccurate in a meaningful way, despite the primary audit purpose being aligned.

Content

No source excerpt is available for this finding.

Lp1

High
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The script enumerates locally installed skills and sends each skill slug to a remote service over the network, but the declared capability set apparently does not include network access. That creates a real permission mismatch and a privacy/security risk because local inventory data leaves the machine and users or policy engines may not expect outbound communication from this skill.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 22)May include surrounding context.

Claude Code

bash
mkdir -p ~/.claude/skills
cd ~/.claude/skills
git clone --depth 1 --filter=blob:none --sparse https://github.com/yangyixxxx/skillguard.git skillguard-check-tmp
cd skillguard-check-tmp

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 34)May include surrounding context.

Claude Code

bash
mkdir -p ~/.claude/skills
cd ~/.claude/skills
git clone --depth 1 --filter=blob:none --sparse https://github.com/yangyixxxx/skillguard.git skillguard-check-tmp
cd skillguard-check-tmp

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 22)May include surrounding context.

Claude Code

bash
mkdir -p ~/.claude/skills
cd ~/.claude/skills
git clone --depth 1 --filter=blob:none --sparse https://github.com/yangyixxxx/skillguard.git skillguard-check-tmp
cd skillguard-check-tmp

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 35)May include surrounding context.

bash
mkdir -p ~/.claude/skills/skillguard-check/scripts
curl -fsSLo ~/.claude/skills/skillguard-check/SKILL.md \
  https://raw.githubusercontent.com/yangyixxxx/skillguard/main/skills/skillguard-check/SKILL.md
curl -fsSLo ~/.claude/skills/skillguard-check/scripts/check.py \
  https://raw.githubusercontent.com/yangyixxxx/skillguard/main/skills/skillguard-check/scripts/check.py

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 36)May include surrounding context.

bash
mkdir -p ~/.claude/skills/skillguard-check/scripts
curl -fsSLo ~/.claude/skills/skillguard-check/SKILL.md \
  https://raw.githubusercontent.com/yangyixxxx/skillguard/main/skills/skillguard-check/SKILL.md
curl -fsSLo ~/.claude/skills/skillguard-check/scripts/check.py \
  https://raw.githubusercontent.com/yangyixxxx/skillguard/main/skills/skillguard-check/scripts/check.py

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill enumerates locally installed skill directories and queries a third-party service using the discovered slugs, but the user-facing description does not clearly warn that local metadata will be sent off-host. Even if only identifiers are transmitted, this can disclose installed tooling, private project names embedded in directory names, or security posture information to an external service without informed consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill says to trigger any time the user expresses concern about installed-skill safety and also on periodic conditions like 'security-sensitive work' when no audit has run this session. Those conditions are broad and lack clear boundaries or negative examples, which increases the chance of the skill being invoked without an explicit user request.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The README says the agent invokes the skill automatically when relevant and gives the example phrase "are my skills safe?", but it does not define a bounded trigger set or exclusion conditions. This can create ambiguity about when the skill should activate versus when a general safety question should not invoke it.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.