ClawHub
Back to skill

Security audit

ClawHub 技能一键发布器

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a real ClawHub publishing helper, but it handles API tokens, publicly uploads local skill contents, runs external tooling, and mutates project ignore files without enough guardrails.

Review the exact skill directory before publishing, avoid passing the API token on the command line, use a short-lived or scoped token, and prefer pinned local dependencies. Treat the publish command as a public upload and check the generated .clawhubignore changes before relying on them.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:38
Finding

API Token Exposure Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:38-41; supporting implementation at scripts/publish.py:408
Vulnerability Type: Credential exposure through process arguments
Risk Level: Medium

Vulnerable Code

bash
export CLAWHUB_TOKEN="your_API_token"

python scripts/publish.py --skill ./skill-dir --slug my-skill --name "My Skill" --token "$CLAWHUB_TOKEN"
python
ap.add_argument("--token", default="")

Technical Analysis

The documented invocation expands CLAWHUB_TOKEN into the --token command-line argument. Although the publishing function subsequently transfers this value to the child process through the CLAWHUB_TOKEN environment variable, the Python wrapper's process arguments still contain the plaintext token.

Command-line arguments may be visible through process inspection facilities, endpoint monitoring, diagnostic tooling, terminal recordings, automation logs, or shell history. This unnecessarily increases credential exposure compared with reading the token directly from the environment or a protected credential provider.

Attack Path

  1. A user exports a valid ClawHub API token and invokes the documented command.
  2. The shell expands $CLAWHUB_TOKEN into a plaintext --token argument.
  3. A local user, monitoring agent, or process-inspection tool records or reads the wrapper process's arguments.
  4. The exposed token is recovered from the process listing, telemetry, or command history.
  5. The attacker authenticates to ClawHub using the stolen token.
  6. The attacker performs publishing operations permitted by the compromised account.

Impact Assessment

Successful exploitation exposes the user's ClawHub API credential. The attacker may obtain the same ClawHub publishing privileges associated with that token, potentially allowing unauthorized publication or modification of Skills. The impact is limited by the permissions, lifetime, and revocation controls o ...[truncated 103 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the --token command-line option and read CLAWHUB_TOKEN directly from os.environ.
  • Update documentation to invoke the script without expanding the secret into the command line:
    bash
    export CLAWHUB_TOKEN="your_API_token"
python scripts/publish.py --skill ./skill-dir --slug my-skill --name "My Skill"
  • If interactive token entry is required, use Python's getpass.getpass() so the value is not echoed or stored in arguments.
  • Prefer an operating-system credential store or short-lived scoped token where supported.
  • Ensure credentials are never printed in standard output, standard error, exception messages, or debug logs.
  • Document token rotation and immediate revocation procedures for suspected exposure.

T08 · Insecure Dependencies

Warning
Location
scripts/publish.py:329
Finding

Unpinned Global Third-Party Dependency Installation Guidance

Content
View full analysis

Vulnerability Details

File Location: scripts/publish.py:329 and scripts/publish.py:388-390
Vulnerability Type: Unpinned third-party dependencies and global package installation
Risk Level: Medium

Vulnerable Code

python
if not cli:
    raise SystemExit("✗ clawhub installation not found (first run npm install -g clawhub, or install it in the node workspace)")
python
except ImportError:
    print("agent-browser or Playwright is not installed; skipping screenshot"
          "(optional: npm i -g agent-browser or pip install playwright && playwright install chromium)")
    return None

Technical Analysis

The script recommends installing clawhub, agent-browser, and playwright without fixed versions or integrity verification. Two packages are explicitly installed globally. Unpinned installation resolves whichever release is current at installation time, making execution non-reproducible and increasing exposure to compromised releases, malicious dependency updates, registry account takeover, or dependency-resolution attacks.

The script later resolves and directly executes JavaScript entry points from installed packages. Consequently, a compromised dependency would execute with the privileges of the user running the publisher. During publication, such code may also inherit environment variables that include the ClawHub token.

The script does not automatically execute these installation commands; exploitation requires a user to follow the displayed guidance and obtain a compromised package or dependency version.

Attack Path

  1. An attacker compromises a recommended package, one of its transitive dependencies, or its registry publishing account.
  2. A user follows the script's guidance and installs the latest unpinned package globally or into the active Python environment.
  3. The package manager resolves and installs the attacker-controlled release without a project ...[truncated 990 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin reviewed package versions rather than installing mutable latest releases, for example by specifying exact versions.
  • Use project-local isolated environments instead of global installations.
  • Add and commit appropriate lockfiles containing resolved dependency versions and integrity metadata.
  • Verify packages against trusted registries and document expected package publishers and checksums where practical.
  • Separate dependency installation from normal Skill execution and require explicit administrative review before upgrades.
  • Run browser automation and publishing dependencies with the minimum necessary filesystem and network permissions.
  • Avoid exposing the ClawHub token to screenshot tooling; construct restricted subprocess environments containing only variables required by each child process.
  • Regularly audit direct and transitive dependencies and establish a controlled update process.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (20)

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md
- 你需要把一个本地技能（含 `SKILL.md` 的文件夹）发布到 [ClawHub](https://clawhub.ai) 公开市场。

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md
- 你需要把一个本地技能（含 `SKILL.md` 的文件夹）发布到 [ClawHub](https://clawhub.ai) 公开市场。

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
86% confidence
Finding

The code clones the full parent environment and passes it to an external CLI, which can expose unrelated secrets such as cloud credentials, CI tokens, or internal service variables to a child process outside the script's strict need-to-know scope. In a publishing tool that invokes third-party Node packages, inherited environment breadth increases the blast radius if that dependency is compromised or logs environment data.

Content

Scanner excerpt · scripts/publish.py (reported line 335)May include surrounding context.

python
"--slug", slug, "--name", name, "--version", version, "--json"]
    if tags:
        cmd += ["--tags", tags]
    env = dict(os.environ)
    if token:
        env["CLAWHUB_TOKEN"] = token
    res = subprocess.run(cmd, capture_output=True, text=True, env=env)

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
84% confidence
Finding

This code again inherits almost the entire environment into a third-party browser automation subprocess, removing only proxy variables. That unnecessarily exposes ambient credentials and internal configuration to a tool that only needs a small subset of variables, making secret leakage more plausible if the package is malicious, compromised, or verbose in diagnostics.

Content

Scanner excerpt · scripts/publish.py (reported line 356)May include surrounding context.

python
注意：浏览器运行时必须关掉本地代理（否则 Chromium 报 ERR_NO_SUPPORTED_PROXIES）；
    open 与 screenshot 顺序执行，agent-browser 通过本地状态保持浏览器会话。
    """
    env = dict(os.environ)
    env.pop("HTTPS_PROXY", None)
    env.pop("HTTP_PROXY", None)
    r1 = subprocess.run([node, ab_js, "open", url],

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill describes capabilities to read environment variables, read/write local files, and invoke shell/CLI commands, but it does not declare any explicit tool scope or permission boundaries. In a publishing automation skill, that omission is dangerous because it can lead to overbroad execution, unexpected file modifications, token access, and accidental public uploads without clear user-consented limits.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documentation promotes automated public publishing, PDF generation, and screenshot capture as a streamlined workflow, but it does not clearly warn that publication is public and that local artifacts will be created and retained. In this context, that increases the risk of users unintentionally exposing proprietary skill contents or leaving sensitive artifacts on disk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill instructs users to export an API token and use non-interactive login, but it does not include handling guidance for sensitive credentials. That is risky because tokens may be exposed via shell history, logs, process environments, CI output, or reused scripts, enabling unauthorized publication or account access.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description states the skill will generate a '中文 PDF 说明文档', which specifies a single language as part of normal behavior. This is a natural-language policy concern because the metadata does not mention any user-selectable language option or justification for restricting output to Chinese.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The top-level docstring explicitly states that the script generates a Chinese PDF, and user-facing strings throughout the file are Chinese-only. This imposes a specific language/locale on users without opt-in or a documented region-specific justification, which matches the language-policy violation category.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The script silently creates or modifies .clawhubignore in the target skill directory, changing user-controlled project files without explicit confirmation. In a publishing tool, unexpected repository mutation can hide artifacts from packaging, alter future behavior, and create integrity or auditability concerns, especially when run in automation against sensitive repos.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/publish.py (reported line 286)May include surrounding context.

python
"""返回 npm 全局模块根（含 clawhub / agent-browser）。"""
    try:
        node = _resolve_node()
        out = subprocess.run([node, "-e",
                              "console.log(require('child_process').execSync('npm root -g').toString().trim())"],
                             capture_output=True, text=True, timeout=30)
        if out.returncode == 0 and out.stdout.strip():

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This workflow publishes local skill contents to a remote service once invoked, but the execution path provides no final confirmation or prominent warning at the point data leaves the system. In a packaging-and-upload skill, that context makes the issue more significant because users may unintentionally exfiltrate local content, metadata, or embedded secrets from the selected directory.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/publish.py (reported line 338)May include surrounding context.

python
env = dict(os.environ)
    if token:
        env["CLAWHUB_TOKEN"] = token
    res = subprocess.run(cmd, capture_output=True, text=True, env=env)
    print(res.stdout)
    if res.returncode != 0:
        print(res.stderr, file=sys.stderr)

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/publish.py (reported line 359)May include surrounding context.

python
env = dict(os.environ)
    env.pop("HTTPS_PROXY", None)
    env.pop("HTTP_PROXY", None)
    r1 = subprocess.run([node, ab_js, "open", url],
                        capture_output=True, text=True, env=env)
    if r1.returncode != 0:
        print(r1.stderr, file=sys.stderr)

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/publish.py (reported line 365)May include surrounding context.

python
print(r1.stderr, file=sys.stderr)
        raise RuntimeError("agent-browser open 失败")
    time.sleep(3)  # 等待页面加载
    r2 = subprocess.run([node, ab_js, "screenshot", str(out_path)],
                        capture_output=True, text=True, env=env)
    if r2.returncode != 0:
        print(r2.stderr, file=sys.stderr)

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description explicitly says the skill generates a Chinese PDF document, and the core functionality reiterates structured Chinese PDF output. This imposes a specific language choice without offering opt-in or explaining a justified region-specific requirement, which can violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The feature list states that the PDF generator produces a structured Chinese document using a built-in Chinese font. No alternative language option or user preference mechanism is mentioned, so the skill appears to force a locale-specific output.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The top-level docstring states the workflow is '生成中文 PDF 说明 → 发布到 ClawHub → 截图留证 → 汇总输出', implying the PDF is part of the complete post-publish evidence chain. But in main(), build_pdf() runs before publish() and screenshot(), so the generated PDF cannot include the later-produced URL/screenshot evidence despite build_pdf() containing code paths for such evidence. This is an active documentation-to-code mismatch, not just an omitted detail.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.secret_argv_exposure

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/publish.py:287

Instructions pass high-value credentials through process argv.

Critical
Code
suspicious.secret_argv_exposure
Location
SKILL.md:41