ClawHub
Back to skill

Security audit

TOSR Test Skill

Security checks for vulnerabilities and agentic risk

Overview

This is an instruction-only integration test skill that openly describes creating, updating, inspecting, and deleting a temporary ClawHub test skill.

Install or run this only if you intend to perform a ClawHub lifecycle test. Use a test account or tightly scoped credentials, confirm the slug is the temporary test skill before update or delete actions, and avoid using broad production permissions.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The skill explicitly describes publishing, updating, and deleting a real remote resource through the live clawhub API, but it does not warn the user that execution will modify external state. That creates a real safety issue because an agent or user may invoke it assuming it is read-only, leading to unintended creation, mutation, or deletion of live data.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
## Notes

This skill is ephemeral and will be automatically deleted after the test completes.
If you see this skill listed on clawhub, it means a test run failed to clean up properly.
Confidence
79% confidence
Finding
The statement that the skill will be 'automatically deleted after the test completes' indicates autonomous execution of a destructive action without an explicit approval checkpoint at deletion time. Even in a test context, autonomous deletion against a real API can remove the wrong resource if identifiers, environment, or authorization scope are misconfigured.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
1. **Publish** — Creates a new skill via POST /api/v1/skills with multipart form data
2. **Inspect** — Retrieves skill metadata via GET /api/v1/skills/{slug}
3. **Update** — Publishes a new version of an existing skill
4. **Delete** — Removes the skill via DELETE /api/v1/skills/{slug}

## Notes
Confidence
91% confidence
Finding
Documenting a DELETE operation against /api/v1/skills/{slug} exposes a destructive capability whose safety depends entirely on how the slug parameter is chosen and constrained. In context, this is more dangerous because the skill is intended to operate on the real clawhub API, so a parameter mix-up, broad credentials, or prompt-driven misuse could delete a legitimate skill rather than an ephemeral test artifact.

Static analysis

No suspicious patterns detected.