OpenClaw Skill Creator

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:42 AM UTC
• Version: 1.0.0

Overview

This is a coherent OpenClaw skill-creation guide, but it repeatedly tells users to run unpinned ClawHub CLI commands during login and publishing.

Install only if you are comfortable with a Spanish-language skill-creation guide and replace the documented `npx clawhub` examples with a pinned, trusted ClawHub CLI version before login or publishing. Review generated skill files before restarting the gateway or publishing them.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:102

Finding

Unpinned Third-Party CLI Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:102, SKILL.md:195, SKILL.md:204-207, SKILL.md:229, and SKILL.md:238
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code

bash

# SKILL.md:102
npx clawhub install nombre-del-skill

bash

# SKILL.md:195
npx clawhub login

bash

# SKILL.md:204-207
npx clawhub publish /mnt/data/openclaw/workspace/.openclaw/workspace/skills/nombre-del-skill \
  --slug nombre-del-skill \
  --name "Nombre del Skill" \
  --version 1.0.0 \
  --tags "tag1,tag2,tag3"

bash

# SKILL.md:229
npx clawhub publish /mnt/data/openclaw/workspace/.openclaw/workspace/skills/nombre-del-skill

bash

# SKILL.md:238
npx clawhub login

Technical Analysis

The documentation repeatedly instructs users or agents to execute npx clawhub without specifying a reviewed package version or verifying package integrity. Depending on the local npm configuration and cache state, npx may retrieve the currently resolved package release from the npm registry and execute its lifecycle or application code with the invoking user's privileges.

Because the effective executable is not pinned, its contents can change after this skill has been reviewed. A compromised package release, package ownership transfer, registry compromise, or unexpected upstream update could therefore introduce arbitrary code into the documented installation, authentication, or publishing workflow.

The login and publishing operations are particularly sensitive. The invoked package may have access to authentication state, environment variables, npm configuration, the OpenClaw workspace, and the skill directory supplied to the publishing command. No malicious dependency or payload is embedded in the audited project itself; the risk arises from unsafe dependency resolution and execution.

Attack Path

1. An attacker compromises ...[truncated 1390 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every invocation to a specific, reviewed release:

   bash

   npx clawhub@<reviewed-version> login
   npx clawhub@<reviewed-version> publish /absolute/path/to/skill
   

2. Verify and document the authoritative npm package name, publisher, source repository, and expected integrity information so users can distinguish it from typosquatted packages.

3. Prefer a controlled installation using a lockfile and integrity-verified package metadata rather than resolving the latest package dynamically on every invocation.

4. Review new package versions before changing the pinned version. Include source review, dependency review, provenance verification, and malware scanning in the update process.

5. Execute the CLI with least privilege in a restricted environment. Limit filesystem access to the intended skill directory and avoid exposing unrelated credentials or environment variables.

6. Use narrowly scoped, revocable authentication tokens for login and publishing. Do not run the CLI from an account with broader permissions than publication requires.

7. Update every affected example and checklist entry consistently so users are not directed back to an unpinned npx clawhub invocation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (10)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

md

El archivo `SKILL.md` **DEBE** comenzar con YAML frontmatter en este formato exacto:

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.

md

El archivo `SKILL.md` **DEBE** comenzar con YAML frontmatter en este formato exacto:

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 356)May include surrounding context.

md

El archivo `SKILL.md` **DEBE** comenzar con YAML frontmatter en este formato exacto:

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This file's user-facing instructions and examples are presented exclusively in Spanish, which can impose a specific language on users without opt-in. The policy allows language constraints only when the skill offers a choice or clearly justifies a region- or locale-specific limitation, which is not present here.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The skill instructs users to run npx clawhub without pinning a specific package version. This allows whatever version is current at execution time to be fetched and executed, creating a supply-chain risk if the package is updated maliciously, compromised, or changed incompatibly.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

This command again invokes npx clawhub without a pinned version, which means the executed code is not deterministic and may change over time. In a skill that teaches users to authenticate and publish artifacts, this increases exposure to package hijack or upstream compromise.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The publish workflow uses npx clawhub without version pinning, so a later or attacker-controlled package version could run during publication. Because this step may handle credentials and local workspace content, the supply-chain risk is more sensitive than a read-only example.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The troubleshooting section repeats an unpinned npx clawhub command, reinforcing insecure execution habits. Repetition across the document makes it more likely users will copy and run mutable remote code without scrutiny.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

This login remediation example also uses unpinned npx clawhub, exposing users to the same supply-chain risk during an authentication-related action. Commands tied to login can be especially risky because they may interact with browser-based auth flows or tokens.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The checklist instructs users to run npx clawhub login without pinning, again normalizing execution of mutable upstream code. While likely not malicious, it is a real security weakness because it broadens the attack surface for package substitution or compromise.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.