ClawHub
Back to skill

Security audit

Skillgate

Security checks for vulnerabilities and agentic risk

Overview

This scanner needs review because crafted file links can expose private document fields, and some verification claims exceed its actual behavior.

Until link containment is fixed, scan untrusted packages in an isolated environment without access to private files. Treat scores as preliminary: benchmark previews execute no tests, dependency handling performs no vulnerability lookup, and JSON provides fuller self-scan suppression disclosure. Correct the packaged command examples before use. Review included source inspection and synthetic serialization checks; platform-specific link behavior was not tested. The evidence supports review concerns, not malicious intent.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
skillgate.py
Finding

Linked skill definitions bypass file-read containment and can disclose external frontmatter

Content
View full analysis

Impact

Sensitive frontmatter from an external private document or configuration can be copied into a scan report or disclosed to the consuming Agent through MCP. This does not demonstrate arbitrary file-content exfiltration or network transmission; the proven disclosure is limited to parsed frontmatter fields.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (31)

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · README.md (reported line 334)May include surrounding context.

md
- **v1.0.0** — Basic security scanner + Trust Score (released!)
- **v1.1.0** — MCP Server integration — let other agents call SkillGate as a tool
- **v1.2.0** — VSCode extension — inline diagnostics while you write skills
- **v1.3.0** — GitHub App — automatically comment on PRs with Trust Score
- **v1.4.0** — Cloud service — team dashboards, shared policy, continuous monitoring

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skillgate.py (reported line 162)May include surrounding context.

python
(r"\bscp\b", "LOW", "scp 文件传输"),  # skillgate: ignore: rule-pattern keyword line (verified false positive)
]

# 3. Credential / secret access
CREDENTIAL_PATTERNS = [
    (re.compile(r"(api[_-]?key|apikey|secret|token|password|passwd|credential)\s*[:=]\s*['\"]([^'\"]{8,})['\"]", re.IGNORECASE),  # skillgate: ignore: rule-pattern library / detection keywords (self-scan)
     "CRITICAL", "硬编码凭证"),

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skillgate.py (reported line 172)May include surrounding context.

python
"INFO", "从环境变量读凭证（安全做法）"),
    (re.compile(r"~\.ssh/", re.IGNORECASE),  # skillgate: ignore: rule-pattern library / detection keywords (self-scan)
     "HIGH", "访问 SSH 密钥目录"),
    (re.compile(r"\.aws/credentials", re.IGNORECASE),  # skillgate: ignore: rule-pattern library / detection keywords (self-scan)
     "HIGH", "访问 AWS 凭证文件"),
    (re.compile(r"\.git-credentials", re.IGNORECASE),  # skillgate: ignore: rule-pattern library / detection keywords (self-scan)
     "HIGH", "访问 Git 凭证文件"),

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skillgate.py (reported line 174)May include surrounding context.

python
"HIGH", "访问 SSH 密钥目录"),
    (re.compile(r"\.aws/credentials", re.IGNORECASE),  # skillgate: ignore: rule-pattern library / detection keywords (self-scan)
     "HIGH", "访问 AWS 凭证文件"),
    (re.compile(r"\.git-credentials", re.IGNORECASE),  # skillgate: ignore: rule-pattern library / detection keywords (self-scan)
     "HIGH", "访问 Git 凭证文件"),
    (re.compile(r"\.netrc", re.IGNORECASE),  # skillgate: ignore: rule-pattern library / detection keywords (self-scan)
     "MEDIUM", "访问 .netrc 凭证文件"),  # skillgate: ignore: rule-pattern library / detection keywords (self-scan)

Credential Access

High
Category
Privilege Escalation
Confidence
80% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skillgate.py (reported line 176)May include surrounding context.

python
"HIGH", "访问 AWS 凭证文件"),
    (re.compile(r"\.git-credentials", re.IGNORECASE),  # skillgate: ignore: rule-pattern library / detection keywords (self-scan)
     "HIGH", "访问 Git 凭证文件"),
    (re.compile(r"\.netrc", re.IGNORECASE),  # skillgate: ignore: rule-pattern library / detection keywords (self-scan)
     "MEDIUM", "访问 .netrc 凭证文件"),  # skillgate: ignore: rule-pattern library / detection keywords (self-scan)
    (re.compile(r"\.npmrc", re.IGNORECASE),  # skillgate: ignore: rule-pattern library / detection keywords (self-scan)
     "MEDIUM", "访问 .npmrc 凭证文件"),  # skillgate: ignore: rule-pattern library / detection keywords (self-scan)

Credential Access

High
Category
Privilege Escalation
Confidence
80% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skillgate.py (reported line 177)May include surrounding context.

python
(re.compile(r"\.git-credentials", re.IGNORECASE),  # skillgate: ignore: rule-pattern library / detection keywords (self-scan)
     "HIGH", "访问 Git 凭证文件"),
    (re.compile(r"\.netrc", re.IGNORECASE),  # skillgate: ignore: rule-pattern library / detection keywords (self-scan)
     "MEDIUM", "访问 .netrc 凭证文件"),  # skillgate: ignore: rule-pattern library / detection keywords (self-scan)
    (re.compile(r"\.npmrc", re.IGNORECASE),  # skillgate: ignore: rule-pattern library / detection keywords (self-scan)
     "MEDIUM", "访问 .npmrc 凭证文件"),  # skillgate: ignore: rule-pattern library / detection keywords (self-scan)
    (re.compile(r"\.pypirc", re.IGNORECASE),  # skillgate: ignore: rule-pattern library / detection keywords (self-scan)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skillgate.py (reported line 178)May include surrounding context.

python
"HIGH", "访问 Git 凭证文件"),
    (re.compile(r"\.netrc", re.IGNORECASE),  # skillgate: ignore: rule-pattern library / detection keywords (self-scan)
     "MEDIUM", "访问 .netrc 凭证文件"),  # skillgate: ignore: rule-pattern library / detection keywords (self-scan)
    (re.compile(r"\.npmrc", re.IGNORECASE),  # skillgate: ignore: rule-pattern library / detection keywords (self-scan)
     "MEDIUM", "访问 .npmrc 凭证文件"),  # skillgate: ignore: rule-pattern library / detection keywords (self-scan)
    (re.compile(r"\.pypirc", re.IGNORECASE),  # skillgate: ignore: rule-pattern library / detection keywords (self-scan)
     "MEDIUM", "访问 .pypirc 凭证文件"),  # skillgate: ignore: rule-pattern library / detection keywords (self-scan)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skillgate.py (reported line 179)May include surrounding context.

python
(re.compile(r"\.netrc", re.IGNORECASE),  # skillgate: ignore: rule-pattern library / detection keywords (self-scan)
     "MEDIUM", "访问 .netrc 凭证文件"),  # skillgate: ignore: rule-pattern library / detection keywords (self-scan)
    (re.compile(r"\.npmrc", re.IGNORECASE),  # skillgate: ignore: rule-pattern library / detection keywords (self-scan)
     "MEDIUM", "访问 .npmrc 凭证文件"),  # skillgate: ignore: rule-pattern library / detection keywords (self-scan)
    (re.compile(r"\.pypirc", re.IGNORECASE),  # skillgate: ignore: rule-pattern library / detection keywords (self-scan)
     "MEDIUM", "访问 .pypirc 凭证文件"),  # skillgate: ignore: rule-pattern library / detection keywords (self-scan)
    (re.compile(r"id_rsa", re.IGNORECASE),  # skillgate: ignore: rule-pattern library / detection keywords (self-scan)

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · skillgate.py (reported line 203)May include surrounding context.

python
录"),
    (r"\bopen\s*\([^)]*['\"]/System/", "HIGH", "写入 macOS 系统目录"),
    (r"\bos\.rename\s*\([^)]*/etc/", "MEDIUM", "重命名 /etc/ 下文件"),
    (r"\bshutil\.move\s*\([^)]*/etc/", "MEDIUM", "移动文件到 /etc/"),
    (r"\btempfile\.mkdtemp\b", "LOW", "创建临时目录"),
    (r"\btempfile\.mktemp\b", "MEDIUM", "mktemp 临时文件竞争风险"),
]

# 5. Prompt injection / LLM-specific risks
PROMPT_INJECTION_PATTERNS = [
    (r"ignore\s+previous\s+instructions", "CRITICAL", "Prompt injection: ignore previous"),
    (r"disregard\s+all\s+previous", "CRITICAL", "Prompt injection: disregard previous"),
    (r"you\s+are\s+now\s+a?n?\s+\w+", "MEDIUM", "Prompt injection: persona override"),
    (r"system\s+prompt\s+leak", "HIGH", "System prompt leak attempt"),
    (r"jailbreak", "CRITICAL", "Jailbreak pattern"),
    (r"reveal\s+your\s+instructions", "HIGH", "Reveal system instructions attempt"),
    (r"reveal\s+your\s+prompt", "HIGH", "Reveal system prompt attempt"),

Instruction Override

High
Category
Prompt Injection
Confidence
80% confidence
Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · skillgate.py (reported line 206)May include surrounding context.

python
# 5. Prompt injection / LLM-specific risks
PROMPT_INJECTION_PATTERNS = [
    (r"ignore\s+previous\s+instructions", "CRITICAL", "Prompt injection: ignore previous"),
    (r"disregard\s+all\s+previous", "CRITICAL", "Prompt injection: disregard previous"),
    (r"you\s+are\s+now\s+a?n?\s+\w+", "MEDIUM", "Prompt injection: persona override"),
    (r"system\s+prompt\s+leak", "HIGH", "System prompt leak attempt"),
    (r"jailbreak", "CRITICAL", "Jailbreak pattern"),

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · skillgate.py (reported line 210)May include surrounding context.

python
(r"you\s+are\s+now\s+a?n?\s+\w+", "MEDIUM", "Prompt injection: persona override"),
    (r"system\s+prompt\s+leak", "HIGH", "System prompt leak attempt"),
    (r"jailbreak", "CRITICAL", "Jailbreak pattern"),
    (r"reveal\s+your\s+instructions", "HIGH", "Reveal system instructions attempt"),
    (r"reveal\s+your\s+prompt", "HIGH", "Reveal system prompt attempt"),
    (r"bypass\s+safety", "HIGH", "Bypass safety guardrails"),
    (r"do\s+not\s+tell\s+the\s+user", "MEDIUM", "Hide actions from user"),

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · skillgate.py (reported line 211)May include surrounding context.

python
(r"system\s+prompt\s+leak", "HIGH", "System prompt leak attempt"),
    (r"jailbreak", "CRITICAL", "Jailbreak pattern"),
    (r"reveal\s+your\s+instructions", "HIGH", "Reveal system instructions attempt"),
    (r"reveal\s+your\s+prompt", "HIGH", "Reveal system prompt attempt"),
    (r"bypass\s+safety", "HIGH", "Bypass safety guardrails"),
    (r"do\s+not\s+tell\s+the\s+user", "MEDIUM", "Hide actions from user"),
    (r"do\s+not\s+mention", "LOW", "Instructed to omit information"),

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
90% confidence
Finding

Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Content

Scanner excerpt · skillgate.py (reported line 212)May include surrounding context.

python
(r"jailbreak", "CRITICAL", "Jailbreak pattern"),
    (r"reveal\s+your\s+instructions", "HIGH", "Reveal system instructions attempt"),
    (r"reveal\s+your\s+prompt", "HIGH", "Reveal system prompt attempt"),
    (r"bypass\s+safety", "HIGH", "Bypass safety guardrails"),
    (r"do\s+not\s+tell\s+the\s+user", "MEDIUM", "Hide actions from user"),
    (r"do\s+not\s+mention", "LOW", "Instructed to omit information"),
    (r"pretend\s+you\s+are", "MEDIUM", "Pretend persona override"),

Instruction Override

High
Category
Prompt Injection
Confidence
90% confidence
Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · skillgate.py (reported line 212)May include surrounding context.

python
(r"jailbreak", "CRITICAL", "Jailbreak pattern"),
    (r"reveal\s+your\s+instructions", "HIGH", "Reveal system instructions attempt"),
    (r"reveal\s+your\s+prompt", "HIGH", "Reveal system prompt attempt"),
    (r"bypass\s+safety", "HIGH", "Bypass safety guardrails"),
    (r"do\s+not\s+tell\s+the\s+user", "MEDIUM", "Hide actions from user"),
    (r"do\s+not\s+mention", "LOW", "Instructed to omit information"),
    (r"pretend\s+you\s+are", "MEDIUM", "Pretend persona override"),

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
90% confidence
Finding

Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Content

Scanner excerpt · skillgate.py (reported line 218)May include surrounding context.

python
(r"pretend\s+you\s+are", "MEDIUM", "Pretend persona override"),
    (r"act\s+as\s+if\s+you\s+are", "MEDIUM", "Act as persona override"),
    (r"forget\s+your\s+rules", "CRITICAL", "Forget your rules"),
    (r"override\s+your\s+guidelines", "CRITICAL", "Override guidelines"),
    (r"ignore\s+your\s+training", "CRITICAL", "Ignore training"),
]

YARA rule 'agent_skill_destructive_autonomous_actions': Autonomous destructive filesystem, shell history, or repository actions in AI agent skills [agent_skills]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · skillgate.py (reported line 383)May include surrounding context.

python
findings:
            result.findings.append(Finding(
                severity=af.severity,
                category="ast-analysis",
                message=f"[AST] {af.message}",
                file=str(filepath),
                line=af.line
            ))
            ast_lines.add(af.line)  # 记录这一行已经报过了
    except Exception as exc:
        # AST analysis failing must never silently pass a file it could not
        # fully inspect — surface it so the report reflects the gap.
        result.findings.append(Finding(
            severity="LOW", category="scan-error",
            message=f"AST 分析失败（正则扫描继续）: {exc}",
            file=str(filepath), line=0,
        ))

    lines = content.splitlines()

    # Helper: check if line is a comment
    def is_comment_line(line: str) -> bool:
        stripped = line.strip()
        return stripped.startswith("#") or stripped.startswith('"""') or stripped.startswith("'''")

    # Helper: check if match

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
100% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · skillgate.py (reported line 702)May include surrounding context.

python
lines = content.splitlines()
    dangerous_sh_patterns = [
        (r"\brm\s+-rf?\s+/", "CRITICAL", "rm -rf / 危险删除"),
        (r"\b(curl|wget)\s+.*\|\s*(sh|bash)", "HIGH", "管道下载执行远程脚本"),
        (r"\bchmod\s+777", "MEDIUM", "chmod 777 权限过松"),
        (r"\bsudo\s+", "MEDIUM", "sudo 权限提升"),

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
100% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · skillgate.py (reported line 702)May include surrounding context.

python
lines = content.splitlines()
    dangerous_sh_patterns = [
        (r"\brm\s+-rf?\s+/", "CRITICAL", "rm -rf / 危险删除"),
        (r"\b(curl|wget)\s+.*\|\s*(sh|bash)", "HIGH", "管道下载执行远程脚本"),
        (r"\bchmod\s+777", "MEDIUM", "chmod 777 权限过松"),
        (r"\bsudo\s+", "MEDIUM", "sudo 权限提升"),

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · skillgate.py (reported line 704)May include surrounding context.

python
dangerous_sh_patterns = [
        (r"\brm\s+-rf?\s+/", "CRITICAL", "rm -rf / 危险删除"),
        (r"\b(curl|wget)\s+.*\|\s*(sh|bash)", "HIGH", "管道下载执行远程脚本"),
        (r"\bchmod\s+777", "MEDIUM", "chmod 777 权限过松"),
        (r"\bsudo\s+", "MEDIUM", "sudo 权限提升"),
    ]

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skillgate.py (reported line 1099)May include surrounding context.

python
# Data/config text files + binary executables are never skipped
    DATA_SUFFIXES = (".yml", ".yaml", ".toml", ".txt", ".json", ".cfg", ".ini",
                     ".xml", ".html", ".csv", ".env")
    BINARY_SUFFIXES = (".exe", ".dll", ".so", ".dylib", ".jar", ".apk", ".msi",
                       ".pyc", ".pyo", ".class", ".scr", ".com", ".pif", ".cpl",
                       ".bin", ".elf", ".wasm", ".dat")

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skillgate.py (reported line 1420)May include surrounding context.

python
if "credential-leak" in categories:
        suggestions.append("硬编码凭证改用环境变量：os.getenv('API_KEY')")
        suggestions.append("不要把 .env 文件提交到 git")

    if "prompt-injection" in categories:
        suggestions.append("移除任何试图绕过 system prompt 的指令")

Instruction Override

High
Category
Prompt Injection
Confidence
80% confidence
Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · skillgate.py (reported line 1424)May include surrounding context.

python
if "prompt-injection" in categories:
        suggestions.append("移除任何试图绕过 system prompt 的指令")
        suggestions.append("不要在 skill 里写 'ignore previous instructions' 这类内容")

    if "filesystem" in categories:
        suggestions.append("避免递归删除操作，或者加白名单检查路径")

MCP server referenced without pinned version: 'npx skills'.

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 17)May include surrounding context.

md
<p align="center">
  <a href="https://www.star-history.com/zhaoxinghua09-cell/skillgate">
    <img src="https://api.star-history.com/badge?repo=zhaoxinghua09-cell%2Fskillgate&type=trending" alt="Star History" height="20" />
  </a>
</p>

The bench_skill tool claims to verify functionality but only returns an unexecuted test plan.

Medium
Category
Excessive Agency
Confidence
99% confidence
Finding

The agent-facing tool description promises executed capability benchmarks and functional verification, while the handler only resolves and returns test definitions. This mismatch can cause agents to treat an untested skill as functionally validated; the explicit dry-run fields in the response mitigate, but do not eliminate, that risk.

Content

No source excerpt is available for this finding.