skill-upgrade-checker

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 2:21 AM UTC
• Version: 0.1.0

Overview

This skill is a disclosed ClawHub upgrade helper that can change installed skills only after confirmation, so it is benign but should be used carefully.

Before installing, understand that this skill can update installed skills through the ClawHub CLI after you approve the proposed commands. Review the version changes, risk rating, and exact `clawhub update` commands carefully, especially for major upgrades, and choose `none` or specific skill names if you do not want bulk changes.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The skill is designed to perform self-/peer-modification by updating installed skills through 'clawhub update'. Even with stated user confirmation, update capability is inherently dangerous because it can alter trusted local functionality, and a compromised or deceptive implementation could trigger unwanted upgrades, install breaking changes, or introduce malicious code from the supply chain.

Content

Scanner excerpt · _meta.json (reported line 13)May include surrounding context.

json

"permissions": [
      "read installed skill list and versions via 'clawhub list'",
      "search registry for latest versions via 'clawhub search'",
      "update skills via 'clawhub update' (only with explicit user confirmation)"
    ]
  },
  "tags": [

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · _meta.json (reported line 11)May include surrounding context.

json

"binaries": ["clawhub"],
    "auth": "Run 'clawhub login' before use. Credentials are stored by the clawhub CLI in its default config path. No environment variables are required by this skill.",
    "permissions": [
      "read installed skill list and versions via 'clawhub list'",
      "search registry for latest versions via 'clawhub search'",
      "update skills via 'clawhub update' (only with explicit user confirmation)"
    ]

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The manifest description begins in Chinese and presents a bilingual description, which may indicate a language expectation without explicitly stating that users can choose their preferred language. Under the language/locale policy rule, user-facing language constraints should be opt-in or clearly documented.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.