ClawHub
Back to skill

Security audit

ClawHub Skill Creator Guide

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent guide for creating ClawHub skills, but it repeatedly recommends unpinned npm CLI commands for login and publishing.

Review before installing or following the commands. Prefer a pinned, verified ClawHub CLI version or a lockfile-controlled local install, and run login/publish from an environment that only has access to the skill files and credentials needed for that operation.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:100
Finding

Execution of Unpinned npm Package Through npx

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:100, SKILL.md:167, SKILL.md:181-185, SKILL.md:190-194, SKILL.md:222, and SKILL.md:231
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code

SKILL.md:100:

bash
npx clawhub install nombre-del-skill

SKILL.md:166-167:

bash
# Ejecutar comando de login
npx clawhub login

SKILL.md:181-185:

bash
npx clawhub publish /ruta/completa/al/skill \
  --slug nombre-del-skill \
  --name "Nombre Display del Skill" \
  --version 1.0.0 \
  --tags "tag1,tag2,tag3"

SKILL.md:190-194:

bash
npx clawhub publish /mnt/data/openclaw/workspace/.openclaw/workspace/skills/lossless-claw-skill \
  --slug lossless-claw-skill \
  --name "Lossless Claw Skill" \
  --version 1.0.0 \
  --tags "latest,lcm,memory,context"

SKILL.md:222:

bash
npx clawhub publish /mnt/data/openclaw/workspace/.openclaw/workspace/skills/nombre-del-skill

SKILL.md:231:

bash
npx clawhub login

Technical Analysis

The instructions invoke npx clawhub without specifying a reviewed package version or validating package integrity. If the package is not already available locally, npx can resolve, download, and execute the package from the configured npm registry. Consequently, the code executed by these commands can change after this skill has been reviewed.

The project does not include a lockfile, checksum, signature-verification procedure, package provenance check, or explicit version constraint for the CLI. This creates a supply-chain trust boundary in which the security of the documented workflow depends on the current registry package and the integrity of its publisher account and distribution infrastructure.

Attack Path

  1. An attacker compromises the npm package publisher, registry account, package distribution path, or another relevant dependency i ...[truncated 1403 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin every documented invocation to a specifically reviewed CLI release:

    bash
    npx --yes clawhub@<verified-version> login
npx --yes clawhub@<verified-version> publish /absolute/path/to/skill \
  --slug skill-name \
  --name "Skill Display Name" \
  --version 1.0.0 \
  --tags "tag1,tag2,tag3"

  2. Replace <verified-version> with an exact version, not latest, a wildcard, or a permissive version range.

  3. Document the expected official package name, publisher, source repository, and release provenance so users can detect typosquatted or substituted packages.

  4. Verify package integrity before execution. Where practical, record and validate the expected registry integrity hash or use npm lockfile integrity metadata in a controlled wrapper project.

  5. Prefer installing the verified CLI through a controlled dependency manifest and lockfile, reviewing the resolved dependency tree, and then executing the locked local binary.

  6. Run authentication and publication from a least-privileged environment with access only to the files and credentials required for the operation.

  7. Review dependency updates before changing the pinned version. Include provenance, maintainer, installation-script, and dependency-diff checks in that review.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (11)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md
El archivo `SKILL.md` **DEBE** comenzar con YAML frontmatter en este formato exacto:

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 157)May include surrounding context.

md
El archivo `SKILL.md` **DEBE** comenzar con YAML frontmatter en este formato exacto:

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 349)May include surrounding context.

md
El archivo `SKILL.md` **DEBE** comenzar con YAML frontmatter en este formato exacto:

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This markdown file contains user-facing instructional content in Spanish, but it does not indicate that the language is optional or that the skill is intended specifically for Spanish-speaking users. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The skill instructs users to run npx clawhub without pinning a specific package version, which can cause whatever version is currently published to npm to be fetched and executed. If the package is compromised, typosquatted, or a malicious update is released, users may execute attacker-controlled code during login or publishing workflows.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

This instance again recommends npx clawhub login without a pinned version, creating a supply-chain execution path from npm at runtime. Because the command is part of an authentication flow, compromise could expose tokens, browser-based auth data, or local environment information.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The publish command uses npx clawhub without version pinning, so the package resolved at execution time may differ from the one tested by the author. That introduces a supply-chain risk where a malicious or unexpected package version can run with the user's local file access and publishing credentials.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The repeated unpinned npx clawhub publish example normalizes executing remote npm code without version control. In this skill's context, that code may access the workspace path and interact with remote services, increasing the blast radius of a compromised package.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The troubleshooting section repeats an unpinned npx clawhub publish command, reinforcing insecure operational guidance. Even though it is only documentation, users commonly copy-paste these commands directly, making the risk practical rather than theoretical.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The unpinned npx clawhub login command appears again in an error-resolution path, where users are especially likely to copy it without scrutiny. A malicious package update at that moment could capture authentication material or execute arbitrary code on the local machine.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The checklist instructs users to confirm that npx clawhub login was run, again without pinning, embedding insecure practice into the publication process. Because this is a recurring pattern throughout the skill, it increases the likelihood of widespread copy-paste execution of an untrusted package version.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.