ClawHub
Back to skill

Security audit

Skill Factory

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent skill-building workflow, but it gives agents broad authority to modify skills, sync them into the active workspace, and publish repositories without enough final safety checks.

Install only if you intentionally want an agent to create and modify skill repositories. Before using publishing or upgrade flows, require an explicit plan, review exact paths and files, scan for secrets, verify Git remotes and visibility, pin the clawhub CLI version, and avoid enabling recurring sync automation unless you fully control the workspace.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:156
Finding

Unpinned Third-Party CLI Installation Creates a Supply-Chain Execution Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 156-167
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

markdown
When the skill is already published and needs a version update on ClawHub, use the `clawhub` CLI:

**Prerequisites:**
- Node.js environment with clawhub package installed:
  ```
  npm install clawhub
  ```
- ClawHub account with device flow login (headless-friendly):
  ```
  clawhub login --device
  # Visit the provided URL, enter the code, authorize in browser
  # Note: login process must stay running in background while user authorizes
  ```

Technical Analysis

The workflow instructs the Agent to install the current registry version of the clawhub npm package without specifying an exact version, lockfile, package integrity hash, or verified publisher identity. Consequently, the dependency resolved during execution may differ from the dependency that existed when the Skill was audited.

npm packages may define installation lifecycle scripts. If such scripts are enabled, a compromised, malicious, or unexpectedly modified package release could execute code as the operating-system user running the Agent. The package would potentially have access to the Agent workspace, user-readable files, environment variables, and active credentials.

The dependency installation is relevant to optional ClawHub publication, but installing an unrestricted latest version exceeds the minimum necessary trust boundary. The Skill should identify and constrain the exact audited dependency release.

Attack Path

  1. An attacker compromises the npm package, its maintainer account, or a future package release.
  2. The attacker publishes a malicious version containing an installation lifecycle script or malicious CLI behavior.
  3. A user requests publication of a Skill to ClawHub.
  4. The Agent follows the documented prerequisite and ...[truncated 963 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the CLI to a reviewed exact version, for example npm install --save-exact clawhub@X.Y.Z.
  2. Use a committed lockfile and verify the package integrity hash before installation.
  3. Document the official npm package name, publisher, and expected registry.
  4. Prefer installation in an isolated environment with access only to the repository intended for publication.
  5. Disable lifecycle scripts with --ignore-scripts unless the audited package demonstrably requires them.
  6. If lifecycle scripts are required, inspect the resolved package contents and scripts before installation.
  7. Run the CLI with minimal filesystem and environment-variable access.
  8. Avoid exposing unrelated Git, npm, cloud, or API credentials to the installation process.
  9. Re-audit and deliberately update the pinned version rather than automatically accepting the latest release.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:170
Finding

Repository Publication Workflow Lacks Mandatory Secret and Destination Validation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 170-189
Vulnerability Type: Unsafe external publication of repository contents
Risk Level: Medium

Vulnerable Code

bash
**Publish update workflow:**
```bash
# 1. Push latest commit to GitHub first
git push origin main

# 2. Tag the release
git tag v<new-version>
git push --tags

# 3. Publish to ClawHub
clawhub skill publish <repo-path> --slug <slug> --version <new-version> --changelog "<summary>"

# 4. Verify
clawhub inspect <slug>

# 5. Sync to local workspace
Copy-Item -Recurse -Force "D:\Agent\WorkBuddy\skills\<skill-name>\*" "$env:USERPROFILE\.workbuddy\skills\<skill-name>\"

Protocol: GitHub first, ClawHub second. Always push to GitHub before publishing to ClawHub. This ensures the source code is available for moderation review and users can link back to the repo.

text

### Technical Analysis

The workflow sends repository contents to GitHub and then publishes the selected repository through ClawHub. External publication is a legitimate part of the declared functionality and is not covert exfiltration. However, the procedure does not require the Agent to verify:

- The resolved URL of the `origin` remote.
- Whether the target repository is public or private.
- The exact commits, files, and tags that will be transmitted.
- Whether tracked files contain credentials, tokens, personal information, proprietary source material, or raw research notes.
- Whether the supplied repository path is the intended clean publication directory.
- Whether the user grants final approval immediately before transmission.

The new-skill workflow asks the user to choose a publication scope, and the structured upgrade workflow requires approval before applying changes. These controls reduce risk but do not replace a final disclosure review because an existing repository may already contain un
...[truncated 1864 chars]
Remediation
View remediation

Remediation Suggestions

  1. Require separate, explicit user approval for GitHub transmission and ClawHub publication.
  2. Immediately before publishing, display and validate:
    • git remote get-url origin
    • The repository owner and visibility.
    • The outgoing commit range and tags.
    • The exact file manifest to be packaged.
  3. Run a local secret scanner over the working tree and complete Git history.
  4. Block publication when credential files, private keys, tokens, environment files, personal information, or other prohibited material are detected.
  5. Review git status, git diff, git diff --cached, and the outgoing commits before pushing.
  6. Publish from a newly created staging directory containing only an explicit allowlist of release files.
  7. Do not rely solely on .gitignore; confirm that excluded material was never previously committed.
  8. Verify that the supplied repository path resolves within the approved workspace and is not a symlink to another location.
  9. Remove the unconditional GitHub-first requirement. Make GitHub publication conditional on the user's chosen distribution scope.
  10. Present a final transmission summary listing destinations, visibility, files, and versions, then obtain confirmation immediately before network transfer.

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (20)

Self-Modification

High
Category
Rogue Agent
Confidence
95% confidence
Finding

The skill is explicitly designed to upgrade and maintain skills, including itself, and includes triggers like 'update skill' and 'upgrade skill'. In the context of an agent skill, self-modification is high risk because ambiguous invocation or weak confirmation can let the agent alter its own behavior, safety boundaries, or published artifacts over time.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md
"我有个skill想法", "skill迭代", "skill打磨", "做一个关于...的skill",
  "skill版本管理", "skill如何发行", "skill如何升级", "skill生产", "skill自动化",
  "更新skill", "升级skill", "维护skill", "升级已有skill", "upgrade skill",
  "update skill", "维护现有skill", "skill版本升级", "skill生命周期".
---

# Skill Factory — The Meta-Skill for Making Skills

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

md
- `SKILL.md` — triggers + workflow (≤200 lines)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 102)May include surrounding context.

md
- `SKILL.md` — triggers + workflow (≤200 lines)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.

md
- `SKILL.md` — triggers + workflow (≤200 lines)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 228)May include surrounding context.

md
- `SKILL.md` — triggers + workflow (≤200 lines)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 233)May include surrounding context.

md
- `SKILL.md` — triggers + workflow (≤200 lines)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 388)May include surrounding context.

md
- `SKILL.md` — triggers + workflow (≤200 lines)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The listing advertises very broad trigger phrases such as 'Just tell your Claw: New skill...' and the metadata includes many natural-language activators in both English and Chinese. Broad activation language increases the chance the skill is invoked unintentionally during normal conversation, which could cause the agent to begin collecting sources, packaging repositories, or otherwise taking workflow actions the user did not explicitly intend.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README explicitly describes an automated upgrade workflow that inspects repositories, applies file changes, updates versions, and syncs workspace state, but it does not warn users that local repositories and workspace files may be modified. In a meta-skill that generates and upgrades other skills, this omission increases the chance of unintended writes, repository corruption, or accidental changes being applied to the wrong path when users invoke the skill with broad or ambiguous inputs.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README advertises a large set of broad trigger phrases such as generic requests to build, update, or package a skill. In a meta-skill that can initiate repo creation, content collection, and publishing workflows, overlapping triggers increase the chance of unintended activation from ordinary conversation, which can cause unauthorized or surprising actions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The file is written as a Chinese-only SOP and presents itself as the standard operating procedure for creating skills, without offering a language choice or documenting that it is restricted to a Chinese-language environment. That can violate language/locale policy when users or collaborators have not opted into that locale.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The activation description says users can provide ideas 'at any time' in any format, including a one-sentence request or just keywords. This is an ambiguous trigger model for a skill-creation workflow because it does not clearly distinguish intentional invocation from ordinary brainstorming or casual mentions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This markdown SOP explicitly instructs creators to make trigger words 'wide enough' to cover all possible user phrasings. That guidance is overly broad and lacks constraints or negative examples, increasing the risk that downstream skills will activate on common everyday language rather than narrow, domain-specific phrases.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill advertises many broad natural-language triggers such as 'build a skill', 'update skill', and similar Chinese variants, making accidental or ambiguous activation likely. In a meta-skill that can create, modify, version, and publish repositories, trigger collisions can cause the agent to enter a powerful workflow when the user may only be asking for advice or discussion.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 11)May include surrounding context.

md
knowledge, and packages it into a GitHub-ready repo. Also supports upgrading
  existing skills with "升级 skill" or "upgrade skill". Built for makers who
  want quality without reinventing the process. Triggers: "新 skill", "做一个skill",
  "build a skill", "create skill", "skill制作", "把这个做成skill", "帮我把...打包成skill",
  "skill升级", "skill发行", "skill factory", "制造skill", "skill工厂", "skill from scratch",
  "我有个skill想法", "skill迭代", "skill打磨", "做一个关于...的skill",
  "skill版本管理", "skill如何发行", "skill如何升级", "skill生产", "skill自动化",

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The quality checklist explicitly instructs authors to make trigger words broad enough to cover all user phrasings, which institutionalizes ambiguous activation behavior. This increases the chance that unrelated conversations about skills are interpreted as commands, especially because this skill can write files and reshape other skills.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The ClawHub publishing section requires broad trigger phrases in the frontmatter description, reinforcing the same unsafe activation pattern at distribution time. This propagates collision-prone behavior to published skills and can amplify accidental invocation across environments.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The legacy upgrade triggers include vague conditions like a user sending a new URL or the system detecting a knowledge gap, which are not clear activation boundaries for a write-capable workflow. That ambiguity can cause opportunistic self-updates or repo modifications without a clearly scoped user request.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

This markdown file contains natural-language guidance indicating the English README was made English-only and split from the Chinese version. That can reflect a language/locale policy choice embedded in the skill materials without clear user opt-in or explanation of why the restriction is necessary.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The policy says README.md must be "English only — no Chinese text anywhere," which enforces a specific language constraint rather than offering a user or maintainer choice. This is a natural-language locale policy restriction and is not justified as a region-specific compliance requirement.

Content

No source excerpt is available for this finding.