ClawHub
Back to skill

Security audit

Manage Agent Skills

Security checks for vulnerabilities and agentic risk

Overview

The skill’s access to agent settings and ability to enable or disable skills are disclosed, purpose-aligned, and supported by preview and recovery controls.

Preview the selected host and every target before applying changes, especially presets or bulk operations. Keep backups and inventory exports private because they can contain secrets or private paths. Verify results in the host after refreshing it, and inspect current state before retrying a failed batch.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

md
cannot be disabled, even with `--force`.

**Gemini CLI:** `--platform gemini` manages `skills.disabled` in user settings;
`--gemini-scope workspace` selects `<cwd>/.gemini/settings.json`. Local workspace,
user and shared roots are indexed. Built-in/extension skills and other settings
layers require host verification. A global `skills.enabled=false` blocks enable.

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.

--platform antigravity --antigravity-surface app disable demo --dry-run

text

App/IDE defaults to `~/.gemini/config`; current CLI defaults to
`~/.gemini/antigravity-cli`. `--antigravity-config` overrides either root.
This adapter parks whole global skill directories in sibling `skills_disabled`;
explain that move in the preview. It does not manage workspace/plugin copies.

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/platforms.md (reported line 16)May include surrounding context.

md
lls`; selected JSONC | `disabledSkills` | Repository disable lists can further restrict user state. |
| OpenClaw | Native inventory or workspace/user/shared fallback | Native `config set` | Requires installed CLI for mutation; eligibility and agent allowlists remain host decisions. |
| Hermes | `$HERMES_HOME/skills`; selected YAML | Global/per-platform disable lists | External skill directories, profiles, environment/app gates are not fully enumerated. |
| Antigravity App/IDE | Selected global `~/.gemini/config/skills` | Directory parking | Workspace, legacy IDE and plugin roots are not managed. |
| Antigravity CLI | `--antigravity-surface cli`: `~/.gemini/antigravity-cli/skills` | Directory parking | Plugin controls belong to `agy plugin`; older releases may use different paths. |
| Gemini CLI (v1.1.1) | Local user/workspace/shared roots; selected JSON/JSONC | `skills.disabled` | Built-in, extension and other settings layers are not merged. |
| OpenCode (v1.1.1) | Global/project/compa

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · scripts/skillctl.py (reported line 2233)May include surrounding context.

python
parser.add_argument(
        "--antigravity-config",
        type=Path,
        help="Antigravity config directory holding skills/ (default ~/.gemini/config).",
    )
    parser.add_argument(
        "--groups",

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/platforms.md (reported line 114)May include surrounding context.

md
Version 1.1.1 adds a separate Gemini adapter; v1.0.1 did not include it.
It discovers user/workspace `.gemini/skills` and `.agents/skills`, honors
`GEMINI_CLI_HOME`, and edits `skills.disabled` in one selected JSON/JSONC file.
`--gemini-scope workspace` uses `<cwd>/.gemini/settings.json`. Global
`skills.enabled=false` in that file blocks enable. Built-in/extension roots,
system configuration and trust gates are not replicated. Settings-file edits
require a restart according to the [configuration reference](https://geminicli.com/docs/reference/configuration/);

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, file_write, shell.

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/skillctl.py (reported line 1036)May include surrounding context.

python
if not self.executable:
            inventory = self._fallback()
        else:
            result = subprocess.run(
                [self.executable, "skill", "list", "--json"],
                cwd=self.cwd,
                shell=False,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/skillctl.py (reported line 1187)May include surrounding context.

python
def _native_json(self, *arguments: str) -> Any | None:
        if not self.executable:
            return None
        result = subprocess.run(
            [self.executable, *arguments],
            cwd=self.cwd,
            env=self._environment(),

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/skillctl.py (reported line 1345)May include surrounding context.

python
completed = 0
            for command in commands:
                try:
                    result = subprocess.run(
                        command,
                        cwd=self.cwd,
                        env=self._environment(),

Static analysis

No suspicious patterns detected.