ClawHub
Back to skill

Security audit

CHIS/CHISF

Security checks for vulnerabilities and agentic risk

Overview

This skill is an installer shortcut that openly uses forced skill installation, but it normalizes bypassing suspicious-package warnings and recommends an unaudited local fallback installer.

Review this skill carefully before installing. Use normal installs where possible, run clawhub inspect first, pin an exact version, verify the publisher/source, and avoid chisf or --force for suspicious packages unless you have independently checked the package and are prepared for it to overwrite existing skills. Do not use the local fallback installer unless you know and trust that binary.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
scripts/chis-chisf.sh:21
Finding
Forced Installation Can Bypass ClawHub Package Safety Warnings<![CDATA[ ## Vulnerability Details **File Location**: `scripts/chis-chisf.sh:21-23`; related guidance in `SKILL.md:29-35`, `SKILL.md:71-73`, and `SKILL.md:84` **Vulnerability Type**: Unsafe forced installation of untrusted third-party Skills **Risk Level**: Medium ### Vulnerable Code `scripts/chis-chisf.sh:21-23`: ```bash chisf) cmd=(clawhub install "$slug" --force --workdir "$workdir" --dir skills) ;; ``` `SKILL.md:29-35`: ```bash clawhub install <slug> --force --workdir /Users/zququ/.openclaw/workspace --dir skills --version <version> ``` ```text Use this when: - package is flagged as suspicious - overwrite behavior is required ``` `SKILL.md:71-73`: ```bash clawhub install proactive-agent --force --workdir /Users/zququ/.openclaw/workspace --dir skills ``` `SKILL.md:84`: ```text If rate limit persists, use the local fallback installer: `/Users/zququ/.local/bin/clawhub-install-safe --force <slug> <workdir>` (or without `--force` when not needed) before switching to another approach. ``` ### Technical Analysis The `chisf` mode unconditionally adds `--force` to the `clawhub install` command. The documentation explicitly recommends this mode when a package has been flagged as suspicious. This changes a package safety warning from a blocking control into a condition for bypassing that control. The package slug and optional version are supplied at runtime. When no version is supplied, the latest available package is installed, meaning the effective third-party content can change after this wrapper has been reviewed. The target package contents are not included in this repository and therefore cannot be validated as part of this audit. The documentation also proposes an external fallback executable, `/Users/zququ/.local/bin/clawhub-install-safe`, including a `--force` option. That executable is not part of the audited project, so its validation, source selection, integrity checks, and installation behavior cannot be confirmed. The wrapper itself do ...[truncated 1859 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Remove the recommendation to force-install packages that have been flagged as suspicious. 2. Make suspicious-package warnings fail closed. Require the user to inspect and independently approve package contents before any override is permitted. 3. Require an exact version rather than installing the latest release by default. 4. Where supported, verify a trusted cryptographic digest or package signature before installation. 5. Separate overwrite approval from trust-warning bypass. An overwrite requirement should not implicitly authorize installation of a package flagged for security reasons. 6. Add an explicit interactive confirmation that identifies the package, version, source, destination, warning status, and overwrite consequences. For noninteractive environments, require a narrowly scoped opt-in flag rather than enabling forced installation through a routine alias. 7. Run installation and later Skill execution with least privilege, restricting filesystem, network, credential, and tool access. 8. Do not recommend the external `clawhub-install-safe` fallback unless its source is included, audited, integrity-verified, and documented. Avoid invoking an unversioned executable from a user-local path for security-sensitive installation. 9. Update the documented workflow to require inspection before installation and abort when inspection reports suspicious content. ]]>

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill explicitly documents a force-install path for packages that are flagged as suspicious or require overwrite, but it does not require any trust verification, backup, or warning about replacing existing local skill files. In a skill-install workflow, normalizing `--force` makes it easier to bypass safety signals and overwrite trusted content with potentially malicious or incompatible packages.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The fallback instruction recommends a local installer binary with `--force` as an alternative when service issues persist, again without any warning about trust, overwrite semantics, or verification of the local tool itself. This is more dangerous than the main flow because it shifts users to a local executable outside the documented `clawhub` path, increasing the chance of bypassing repository controls and installing untrusted or tampered content.