ClawHub
Back to skill

Security audit

OpenClaw Skill Creator (yejay7)

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Spanish guide for creating OpenClaw skills, but it repeatedly recommends running an unpinned remote ClawHub CLI during login and publishing.

Install only if you are comfortable with a Spanish-language skill-creation guide. Before following its ClawHub login or publish steps, prefer a pinned and trusted clawhub CLI version, verify the package source, and run publishing from an isolated workspace with only the skill files and credentials needed for that task.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:195
Finding

Unpinned npm CLI Package Executed Through npx

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:102, SKILL.md:195, SKILL.md:204-207, SKILL.md:229, and SKILL.md:238
Vulnerability Type: Supply-chain exposure caused by an unpinned runtime dependency
Risk Level: Medium

Vulnerable Code

SKILL.md:102:

bash
npx clawhub install nombre-del-skill

SKILL.md:195:

bash
npx clawhub login

SKILL.md:204-207:

bash
npx clawhub publish /mnt/data/openclaw/workspace/.openclaw/workspace/skills/nombre-del-skill \
  --slug nombre-del-skill \
  --name "Nombre del Skill" \
  --version 1.0.0 \
  --tags "tag1,tag2,tag3"

SKILL.md:229:

bash
npx clawhub publish /mnt/data/openclaw/workspace/.openclaw/workspace/skills/nombre-del-skill

SKILL.md:238:

bash
npx clawhub login

Technical Analysis

The Skill directs an agent or user to invoke the clawhub npm package through npx without specifying an exact reviewed version or integrity constraint. If the package is not already installed locally, npx can retrieve package code from the configured npm registry and execute it at runtime.

Consequently, the effective executable code is not contained in this project and can change after the Skill has been audited. The project also contains no package lockfile, integrity hash, or vendored CLI implementation with which to verify the code that will execute.

This is a supply-chain weakness rather than evidence that the current clawhub package is malicious. Exploitation depends on the registry package, publishing account, dependency chain, registry configuration, or package resolution process being compromised.

Attack Path

  1. An agent or user follows one of the documented npx clawhub commands.
  2. npx resolves the unpinned clawhub package using the environment's configured npm registry.
  3. A compromised or unexpectedly changed release is downloaded if a suitable trusted local copy is una ...[truncated 1020 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace unversioned invocations with an exact, previously reviewed CLI version, for example through a project dependency pinned in package.json.
  2. Commit the generated lockfile and install dependencies using a lockfile-enforcing command such as npm ci.
  3. Verify package provenance, publisher identity, registry origin, and integrity before approving a new version.
  4. Configure an explicit trusted npm registry rather than relying on an uncontrolled environment-level registry configuration.
  5. Prefer a separately installed and reviewed CLI binary over allowing npx to download executable code implicitly during a sensitive login or publishing operation.
  6. Run the CLI with least privilege in an isolated environment that has access only to the Skill directory being published.
  7. Avoid exposing unrelated environment variables, credentials, SSH material, or workspace files to the publishing process.
  8. Document an update-review process so that changing the pinned CLI version requires renewed security review and testing.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (11)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

md
El archivo `SKILL.md` **DEBE** comenzar con YAML frontmatter en este formato exacto:

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.

md
El archivo `SKILL.md` **DEBE** comenzar con YAML frontmatter en este formato exacto:

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 356)May include surrounding context.

md
El archivo `SKILL.md` **DEBE** comenzar con YAML frontmatter en este formato exacto:

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The natural-language instructions throughout the skill are exclusively in Spanish, including the description and all usage guidance. Under the policy, forcing a specific language without user opt-in can be a locale/language policy violation when no alternative or opt-in is provided.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The skill instructs users to run npx clawhub login without pinning a specific package version. npx may fetch the latest package at execution time, which creates a supply-chain risk if the package is compromised, a malicious version is published, or behavior changes unexpectedly. Because this skill is specifically about creating and publishing skills, users are likely to copy-paste these commands directly, increasing the chance of unsafe execution.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding

The command npx clawhub publish ... invokes an unpinned package from the registry, which can execute arbitrary code during install or runtime. This is a real supply-chain exposure, especially because publishing workflows often involve credentials, repository metadata, and local filesystem access that could be abused by a compromised package.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

This finding is a true vulnerability because it again directs use of npx clawhub without a pinned version. Repeated unpinned instructions normalize fetching and executing mutable remote code, which can be exploited through package compromise or dependency hijacking.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The error-resolution guidance tells the user to rerun npx clawhub publish using an absolute path, but still leaves the remote package unpinned. Even in troubleshooting text, this encourages executing the latest registry code in a workflow that may touch local project files and publication credentials.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The login troubleshooting step again references npx clawhub login without version pinning, exposing users to the same supply-chain risk at an authentication step. Since login flows commonly handle tokens or browser-based auth, compromise here could have account impact beyond the local machine.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The checklist reinforces use of npx clawhub login as a normal setup step without pinning. This increases risk by making insecure execution part of the recommended baseline workflow, not just an isolated example.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The description text forces a specific language presentation in natural language and does not state that the skill is intended only for Spanish-speaking users or provide any opt-in for language choice. This can conflict with a language or locale policy that requires user choice or explicit justification for a fixed language.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.