Security audit

Skill Publisher

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real publishing tool, but serious flaws could leak files during publication or run commands when handling an untrusted skill.

Install only if you understand the publishing targets and are comfortable auditing the exact directory before publishing. Do not run its version or publish commands on untrusted skill directories, avoid --yes until you have reviewed the archive contents, and keep secrets, .env files, private keys, backups, and repository metadata out of the skill folder.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/version.sh:153
Finding: GNU sed Command Injection Through Untrusted Existing Version Metadata
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/validate.sh:71
Finding: Sensitive-Content Validation Is Warning-Only and Does Not Prevent Publication
Content: View full analysis
/dev/null | head -1 > /dev/null 2>&1; then found_sensitive+=("$kw") fi done if (( ${#found_sensitive[@]} > 0 )); then warnings+=("Sensitive keywords found in files: ${found_sensitive[*]}") fi ``` A successful validation result, including its warnings, is captured but not shown before packaging: ```bash _pub_log "Validating skill..." local validate_result validate_result=$(validate_run "$skill_path") || { _pub_err "Validation failed:" echo "$validate_result" >&2 return 1 } # Step 2: Get version local version version=$(_version_extract "$skill_path/SKILL.md") || version="0.0.0" local name name=$(grep -m1 '^name:' "$skill_path/SKILL.md" | sed 's/^name:\s*//' | sed 's/^"$.*$"$/\1/' | xargs) || name="unknown-skill" local slug slug="${slug_override:-$name}" # Step 3: Package tarball _pub_log "Packaging $name@$version..." local tmp_dir tmp_dir=$(mktemp -d) local tarball_path="$tmp_dir/${name}-${version}.tar.gz" local base_dir base_dir=$(basename "$skill_path") tar -czf "$tarball_path" -C "$(dirname "$skill_path")" "$base_dir" ``` ### Technical Analysis The documentation states that files containing sensitive keywords are not published. The implementation does not enforce that rule: detections are warnings, validation still returns success, and the warning-bearing JSON is discarded. The archive operation includes the entire skill directory without an allowlist or exclusions for common sensitive files such as `.env`, private configuration, local credential files, repository metadata, backu ...[truncated 1425 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/publish.sh:159
Finding: Unvalidated Skill Name and Version Permit Archive Path Traversal
Content: View full analysis
.tar.gz` suffix limits which exact filenames can be targeted directly but does not prevent unauthorized file placement or overwrite of matching pa ...[truncated 917 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/platform_clawhub.sh:91
Finding: ClawHub-Based Adapters Publish a Mutable Live Directory Instead of the Validated Artifact
Content: View full analysis
&1); then ``` SkillHub behaves similarly: ```bash # Publish to ClawHub (which triggers SkillHub sync) _pub_log " SkillHub 是 ClawHub 镜像，正在发布到 ClawHub..." local clawhub_args=("publish" "$skill_path") [[ -n "$slug" ]] && clawhub_args+=("--slug" "$slug") [[ -n "$version" ]] && clawhub_args+=("--version" "$version") local pub_output if pub_output=$(clawhub "${clawhub_args[@]}" 2>&1); then ``` ### Technical Analysis The orchestrator validates a directory and creates a tarball representing its contents at one point in time. The adapters then ignore that immutable artifact and ask an external CLI to rescan the original directory. Consequently, there is no guarantee that the published data is the data that passed validation. Files can be added, replaced, or modified after validation or packaging but before the external CLI reads them. This is a time-of-check/time-of-use integrity problem. The issue is especially relevant for directories concurrently modified by build processes, repository hooks, synchronization tools, or another local process. It also prevents reliable auditing because the generated tarball i ...[truncated 890 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: README.md:29
Finding: Installation Guidance Uses an Unpinned Global npm Dependency
Content: View full analysis
Remediation: View remediation
`. - Document the expected package publisher, registry, integrity hash, and official verification source. - Prefer a project-local locked dependency or verified standalone release over an unconstrained global installation. - Enable npm provenance and signature verification where available. - Review new versions before updating the documented pin. - Avoid privileged installation and advise users not to run npm as root. - Consider verifying the resolved `clawhub` binary version before authentication or publication. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (23)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: 声明描述的是一个完整的多平台发布技能，核心能力应包括面向多个平台的发布，以及验证、打包、版本管理和统一发布流程。实际代码块只是单独的 ClawHub shell 适配脚本，负责检查 clawhub CLI 是否安装/登录、调用 clawhub publish 发布、查询状态并输出 JSON 结果。它确实支持部分验证和版本/changelog 参数，但范围仅限 ClawHub，且没有看到 GitHub Releases、SkillHub CN、统一编排逻辑或打包实现。因此，代码行为只覆盖声明中的一个子集，且主用途明显更窄，构成描述与行为不一致。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: 声明的核心用途是“发布到多个平台”，包括验证、打包、版本管理和一键发布；但提供的代码仅是 status.sh 状态模块。它会读取技能元数据、发现平台适配器、调用 platform__status 查询函数，并输出状态 JSON。代码中没有执行发布、打包、上传、创建 Release、版本变更或多平台发布编排等行为。虽然“查询发布状态”可能属于发布工具链的辅助功能，但该代码块本身的实际主功能与声明的主要用途存在明显偏差，因此应判定为描述与行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents the skill as a multi-platform release/publishing tool with validation, packaging, version management, and one-click publishing. The actual code chunk only implements local validation logic for a skill directory and metadata. There are no network calls, release creation steps, archive/build steps, version bumping/tagging logic, authentication handling, or platform-specific publishing actions. While validation is mentioned in the description, the supplied code does not substantiate the primary declared purpose of publishing across multiple platforms, so the description materially overstates the behavior of this code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: 声明描述的是一个完整的多平台发布技能，而实际代码只是一个 version.sh 模块，专注于本地 SKILL.md 文件中的版本读取、更新和写回。虽然“版本管理”属于声明中的一部分，但该代码块没有展示发布、打包、验证或与任何外部平台交互的行为，因此与声明的主要用途相比明显过窄，不能准确代表所宣称的整体能力。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The primary skill description is presented only in Chinese, with no indication that users may choose another language or that the skill is region-specific. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file consistently uses Chinese for the description, commands context, and safety rules, which effectively forces a specific language for users. The policy allows locale constraints only when users are given a choice or when the restriction is clearly justified as region-specific, neither of which is stated for the overall skill.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The example annotation uses @auth_check: echo $MYPLATFORM_TOKEN, which prints the secret value directly to stdout. In a publishing skill, stdout is commonly captured by wrappers, logs, CI systems, or JSON parsers, so this contradicts the document's own rule against outputting credentials and can leak live API tokens.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The api_key authentication example again uses @auth_check: echo $MY_TOKEN, which directly exposes the API key. Because this document is a template for adapter authors, it is likely to be copied into real implementations and can systematically cause credential disclosure across platforms.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/adding-platforms.md (reported line 171)May include surrounding context.
md
tar -xzf "$tarball_path" -C "$tmp_dir" find "$tmp_dir" -type f | while read -r file; do curl -X POST -F "file=@$file" "https://api.myplatform.com/upload" done rm -rf "$tmp_dir"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/adding-platforms.md (reported line 186)May include surrounding context.
md
tar -xzf "$tarball_path" -C "$tmp_dir" find "$tmp_dir" -type f | while read -r file; do curl -X POST -F "file=@$file" "https://api.myplatform.com/upload" done rm -rf "$tmp_dir"

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This markdown file documents adapter behavior that uploads tarballs over HTTP APIs, including an Authorization header and file transfer to a remote endpoint. Under the markdown-specific SQP-2 criteria, the description lacks an explicit warning that skill contents and related metadata may be transmitted to external platforms, which could affect privacy or system integrity.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/platform-interface.md (reported line 275)May include surrounding context.
bash
platform_<name>_publish() { local tarball_path="$1" curl -X POST \ -H "Authorization: Bearer $TOKEN" \ -F "file=@$tarball_path" \ "https://api.platform.com/skills"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/platform-interface.md (reported line 278)May include surrounding context.
curl -X POST
-H "Authorization: Bearer $TOKEN"
-F "file=@$tarball_path"
"https://api.platform.com/skills" }

text

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The publish function performs a network operation that creates a GitHub release and uploads the provided tarball via gh release create. Although comments describe the function's purpose, there is no user-facing prompt, warning, or visible disclosure at execution time before transmitting data to GitHub.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: platform_load dynamically sources platform_${target_name}.sh into the current shell, so any shell code in that adapter executes immediately with the caller's privileges. Although the path is constrained to the local scripts directory and quoted, this still creates a code-execution trust boundary: if an attacker can add or modify a platform adapter file, invoking platform_load will run arbitrary commands without isolation or explicit confirmation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This shell script's natural-language output, comments, labels, and help text are consistently in Chinese, including operational errors and usage guidance. The file does not offer any language/locale selection or clearly justify that the skill is intended only for Chinese-speaking or region-specific users, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The user-facing help and safety guidance are entirely written in Chinese, which imposes a specific language on users of this skill. There is no indication that the tool is region-specific or that users can opt into another language, so this is a natural-language locale policy issue.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The help text states that sensitive information is not logged, but the publish path appends raw adapter output into the returned JSON summary via the detail field. If a platform adapter prints tokens, upload URLs, request headers, or other secrets, those values can be exposed to callers, captured by logs, or stored by downstream systems that record command output.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown file contains user-facing instructional content only in Chinese, and there is no indication that the skill or documentation is region-specific or that users can opt into a preferred language. Under the policy rule for language/locale constraints, forcing a single language without opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The markdown includes a concrete example of sending a POST request to a Slack webhook containing skill name and version. The surrounding documentation does not warn users that publication events may be disclosed to external collaboration services, which is the type of behavioral warning SQP-2 expects in markdown descriptions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file includes user-facing auth/install hints and help text in Chinese, such as "请先运行" and "官方技能注册平台", with no indication that language is configurable or optional. This can violate a language/locale policy when users are not given an opt-in choice for the interface language.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The auth_hint string is written only in Chinese, and the help text also uses Chinese phrasing, which imposes a specific language on users without opt-in. This is a natural-language policy concern because the file provides user-facing guidance but does not offer a locale choice or document a justified region-specific constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The help banner presents the skill description in Chinese only, which may violate language/locale policy when no user choice is offered. The file does not indicate that the skill is region-specific or that users can select their preferred language.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.