ClawHub
Back to skill

Security audit

Skill Lookup

Security checks for vulnerabilities and agentic risk

Overview

This skill is meant to search and install other skills, but its install workflow writes untrusted registry files into an agent skill-loading directory without enough validation or review controls.

Review this skill carefully before installing. It should only be used with registries and publishers you trust, and installs should require a visible file manifest, safe filename checks, content inspection, and explicit confirmation before anything is written into .claude/skills/.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Error
Location
SKILL.md:45
Finding

Untrusted Remote Skill Installation Without Security Validation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 45–61
Vulnerability Type: Supply-chain exposure through unverified third-party Skill installation
Risk Level: High

Vulnerable Code

markdown
Returns the skill metadata and all file contents:
- SKILL.md (main instructions)
- Reference documentation
- Helper scripts
- Configuration files

## How to Install a Skill

When the user asks to install a skill:

1. Call `get_skill` to retrieve all files
2. Create the directory `.claude/skills/{slug}/`
3. Save each file to the appropriate location:
   - `SKILL.md` → `.claude/skills/{slug}/SKILL.md`
   - Other files → `.claude/skills/{slug}/{filename}`
4. Read back `SKILL.md` to verify the frontmatter is intact

Technical Analysis

The workflow retrieves registry-controlled files—including agent instructions, helper scripts, and configuration—and places them directly in .claude/skills/, an Agent Skill loading location. It does not require publisher authentication, cryptographic integrity verification, an allowlist, static analysis, script review, or a complete user preview before installation.

Reading back SKILL.md and checking that its frontmatter remains intact verifies only file presence or formatting; it does not establish that the retrieved content is trustworthy. A malicious publisher or compromised registry entry could therefore distribute prompt-injection instructions or executable helper scripts through this installation workflow.

No malicious payload exists in the audited package itself. The vulnerability is that it creates an unsafe third-party component installation path.

Attack Path

  1. An attacker publishes a malicious Skill to the external registry or compromises an existing registry entry.
  2. The attacker places harmful agent instructions, helper scripts, or configuration in the Skill package.
  3. A user searches for and selects that Skill.
  4. The workflow invokes get_skill and receives the attacker-controlled ...[truncated 836 chars]
Remediation
View remediation

Remediation Suggestions

  1. Require explicit user confirmation after displaying the complete file manifest, publisher identity, and security-relevant contents.
  2. Authenticate the registry and publisher, and verify a cryptographic signature or pinned digest for every downloaded file.
  3. Restrict installation to approved registries and trusted publisher allowlists.
  4. Download packages into a quarantine directory rather than directly into .claude/skills/.
  5. Scan all instruction files for prompt-injection patterns and inspect scripts for dangerous commands, network access, credential access, persistence, and destructive operations.
  6. Warn separately when a package contains executable files and require additional confirmation before enabling them.
  7. Apply least-privilege sandboxing when installed Skills or helper scripts are used.
  8. Record package provenance, version, hashes, publisher, and review status to support later verification and revocation.
  9. Treat frontmatter validation as a formatting check only, not as a security control.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:54
Finding

Unsanitized Registry-Controlled Installation Paths

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 54–61
Vulnerability Type: Path traversal and unintended file overwrite risk
Risk Level: High

Vulnerable Code

markdown
When the user asks to install a skill:

1. Call `get_skill` to retrieve all files
2. Create the directory `.claude/skills/{slug}/`
3. Save each file to the appropriate location:
   - `SKILL.md` → `.claude/skills/{slug}/SKILL.md`
   - Other files → `.claude/skills/{slug}/{filename}`
4. Read back `SKILL.md` to verify the frontmatter is intact

Technical Analysis

The installation destinations are constructed from {slug} and {filename}, but the instructions do not require validation, canonicalization, or containment checks. Because these values can originate in retrieved registry metadata, a malicious entry could potentially supply absolute paths, parent-directory components such as ../, path separators, control characters, or symlink-based redirections.

For example, joining an installation root with a filename such as ../../settings.json could resolve outside the intended Skill directory in an implementation that performs ordinary filesystem path joining. Merely reading back SKILL.md does not detect writes performed through other malicious filenames.

Exploitability depends on the path-handling and filesystem safeguards implemented by the agent's file tools. Nevertheless, the documented installation procedure does not prescribe the controls needed to maintain directory containment.

Attack Path

  1. An attacker publishes or compromises a registry Skill.
  2. The registry response contains a crafted slug or filename with traversal components or an absolute path.
  3. The user chooses to install the Skill.
  4. The agent constructs the destination according to .claude/skills/{slug}/{filename} without validating the untrusted components.
  5. The resulting path resolves outside the intended installation directory.
  6. The file-writing tool creates or overwri ...[truncated 784 chars]
Remediation
View remediation

Remediation Suggestions

  1. Accept slugs only if they match a strict allowlist pattern such as ^[a-z0-9][a-z0-9-]{0,63}$.
  2. Require each package path to be a normalized relative path and reject absolute paths, drive prefixes, URI-like paths, empty components, . components, and .. components.
  3. If nested package files are unnecessary, accept basenames only and reject all directory separators.
  4. Resolve the canonical destination before writing and verify that it remains beneath the canonical .claude/skills/{validated-slug}/ root.
  5. Reject symlinks and prevent traversal through pre-existing symlinked parent directories.
  6. Refuse overwrites by default, especially for files outside a newly created installation directory.
  7. Install into a newly created temporary quarantine directory, validate the complete tree, and then atomically move it to the final destination.
  8. Enforce maximum path lengths, file counts, and file sizes.
  9. Log every resolved destination and present it to the user before committing the installation.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest says to use the skill when the user asks to 'find skills, browse skill catalogs, install a skill for Claude, or extend Claude's capabilities,' but it does not define clear trigger boundaries or exclusions. The phrase 'extend Claude's capabilities' is especially broad and could overlap with many generic assistance requests, increasing the risk of unintended invocation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill instructs the agent to write arbitrary retrieved files into the local .claude/skills/{slug}/ directory without requiring explicit confirmation or warning that local files will be modified. Because retrieved skill contents are treated as installable artifacts, this can lead to unreviewed persistence of untrusted instructions or helper files on the user's machine, increasing the risk of supply-chain style compromise through malicious or deceptive registry content.

Content

No source excerpt is available for this finding.