ClawHub
Back to skill

Security audit

ClawHub 技能一键发布器

Security checks for vulnerabilities and agentic risk

Overview

This skill automates publishing a user-selected local skill to ClawHub, and its file writes, token use, upload, and screenshot behavior are mostly disclosed and purpose-aligned.

Before using this skill, confirm the selected skill directory contains only files intended for public release, review or create .clawhubignore, and use a ClawHub token with only the access needed for publishing. Treat the generated PDF, screenshot, and public ClawHub upload as intentional outputs of the workflow.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill describes access to environment variables, local file read/write, and shell execution, yet declares no permissions or user-consent boundaries. That mismatch is dangerous because the workflow includes packaging local content, generating files, and publishing to an external service using an API token, which can lead to unintended data exposure or filesystem modification without clear disclosure.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill explicitly automates local file creation, screenshot generation, and publication to an external marketplace, but does not prominently warn that it will modify local files and transmit package contents off-host. This is risky because users may trigger the workflow expecting documentation help, while the skill can create artifacts and publish potentially sensitive material using available credentials.

Unvalidated Output Injection

High
Category
Output Handling
Content
env = dict(os.environ)
    if token:
        env["CLAWHUB_TOKEN"] = token
    res = subprocess.run(cmd, capture_output=True, text=True, env=env)
    print(res.stdout)
    if res.returncode != 0:
        print(res.stderr, file=sys.stderr)
Confidence
76% confidence
Finding
The script prints untrusted stdout from the external `clawhub` CLI directly to the terminal. If a compromised or malicious CLI/package emits ANSI escape sequences or deceptive control characters, it can manipulate terminal output, hide warnings, spoof success, or trick users during a sensitive publish workflow.

Unvalidated Output Injection

High
Category
Output Handling
Content
env = dict(os.environ)
    env.pop("HTTPS_PROXY", None)
    env.pop("HTTP_PROXY", None)
    r1 = subprocess.run([node, ab_js, "open", url],
                        capture_output=True, text=True, env=env)
    if r1.returncode != 0:
        print(r1.stderr, file=sys.stderr)
Confidence
74% confidence
Finding
On failure, the script prints stderr from `agent-browser` directly to the terminal, which is untrusted output from an external tool processing a remote URL. A malicious package, page-triggered browser error, or compromised toolchain could inject terminal control sequences or misleading content into the operator's session.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.secret_argv_exposure

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/publish.py:287

Instructions pass high-value credentials through process argv.

Critical
Code
suspicious.secret_argv_exposure
Location
SKILL.md:41