Security audit

CHIS/CHISF

Security checks for vulnerabilities and agentic risk

Overview

This skill is an installer shortcut that openly uses forced skill installation, but it normalizes bypassing suspicious-package warnings and recommends an unaudited local fallback installer.

Review this skill carefully before installing. Use normal installs where possible, run clawhub inspect first, pin an exact version, verify the publisher/source, and avoid chisf or --force for suspicious packages unless you have independently checked the package and are prepared for it to overwrite existing skills. Do not use the local fallback installer unless you know and trust that binary.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: scripts/chis-chisf.sh:21
Finding: Forced Installation Can Bypass ClawHub Package Safety Warnings
Content: View full analysis
--force --workdir /Users/zququ/.openclaw/workspace --dir skills --version ``` ```text Use this when: - package is flagged as suspicious - overwrite behavior is required ``` `SKILL.md:71-73`: ```bash clawhub install proactive-agent --force --workdir /Users/zququ/.openclaw/workspace --dir skills ``` `SKILL.md:84`: ```text If rate limit persists, use the local fallback installer: `/Users/zququ/.local/bin/clawhub-install-safe --force ` (or without `--force` when not needed) before switching to another approach. ``` ### Technical Analysis The `chisf` mode unconditionally adds `--force` to the `clawhub install` command. The documentation explicitly recommends this mode when a package has been flagged as suspicious. This changes a package safety warning from a blocking control into a condition for bypassing that control. The package slug and optional version are supplied at runtime. When no version is supplied, the latest available package is installed, meaning the effective third-party content can change after this wrapper has been reviewed. The target package contents are not included in this repository and therefore cannot be validated as part of this audit. The documentation also proposes an external fallback executable, `/Users/zququ/.local/bin/clawhub-install-safe`, including a `--force` option. That executable is not part of the audited project, so its validation, source selection, integrity checks, and installation behavior cannot be confirmed. The wrapper itself do ...[truncated 1859 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill explicitly documents a force-install path for packages that are flagged as suspicious or require overwrite, but it does not require any trust verification, backup, or warning about replacing existing local skill files. In a skill-install workflow, normalizing --force makes it easier to bypass safety signals and overwrite trusted content with potentially malicious or incompatible packages.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The fallback instruction recommends a local installer binary with --force as an alternative when service issues persist, again without any warning about trust, overwrite semantics, or verification of the local tool itself. This is more dangerous than the main flow because it shifts users to a local executable outside the documented clawhub path, increasing the chance of bypassing repository controls and installing untrusted or tampered content.
Content: No source excerpt is available for this finding.