Skills/ClawHub/dcl-skill-auditor

dcl-skill-auditor@1.0.3

CAUTION· install only

Publisher claims: "Scan any ClawHub skill before installing it. 534 out of 3,984 ClawHub skills contained critical vulnerabilities — credential theft, prompt injection, data exfiltration. Snyk Research, 2026. DCL Skill Auditor analyzes SKILL.md, scripts, and manifests against 30+ known attack patterns..." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher daririnch · publishing for 110 daysInstalls 1,434Last detonated 4d ago
What would fix thisWatchDispute verdict

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-10 and scored it 74/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Reads credential paths from the home directory; Pipe-to-shell pattern; Prompt injection. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

HIGH
Reads credential paths from the home directorySKILL.md:196 · Reads credential paths from the home directory- [ ] Script reads `~/.ssh/`, `~/.aws/credentials`, `~/.config/`Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
HIGH
Pipe-to-shell patternSKILL.md:63 · Pipe-to-shell pattern — downloads and immediately executes remote code- `curl | bash` or `wget | sh` patternsFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
CRITICAL
Prompt injectionSKILL.md:201 · Prompt injection — known jailbreak technique reference- [ ] Role-switch: "you are now", "act as", "pretend you are", "DAN", "STAN", "jailbreak"Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
HIGH
References a credential file in the home directorySKILL.md:196 · References a credential file in the home directory- [ ] Script reads `~/.ssh/`, `~/.aws/credentials`, `~/.config/`Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
HIGH
Pipe-to-shell patternSKILL.md:206 · Pipe-to-shell pattern — downloads and immediately executes remote code- [ ] `curl * | bash`, `wget * | sh`, `curl * | python`Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
CRITICAL
Prompt injectionSKILL.md:401 · Prompt injection — known jailbreak technique reference- `dcl-prompt-firewall` — Input-layer injection and jailbreak detectionFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
CRITICAL
Prompt injectionSKILL.md:58 · Prompt injection — known jailbreak technique reference- Role-switch attempts ("you are now", "act as", "DAN mode")Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
CRITICAL
Prompt injectionSKILL.md:400 · Prompt injection — known jailbreak technique reference- `dcl-policy-enforcer` — Compliance and jailbreak detection for AI outputsFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
HIGH
Access to sensitive file pathsSKILL.md:196 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- [ ] Script reads `~/.ssh/`, `~/.aws/credentials`, `~/.config/`Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsSKILL.md:208 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- [ ] Data exfil via POST: `curl -d @/etc/passwd`, `curl -F file=@`Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Financial transfer languageSKILL.md:54 · Financial transfer language — potential advance-fee scam- Crypto wallet address collectionFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Remote installer piped to shellSKILL.md:63 · Remote installer piped to shell- `curl | bash` or `wget | sh` patternsFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
HIGH
Financial transfer languageSKILL.md:197 · Financial transfer language — potential advance-fee scam- [ ] Crypto wallet patterns: `0x[0-9a-f]{40}`, `bc1q`, `[13][a-zA-Z0-9]{25,34}`Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Remote installer piped to shellSKILL.md:206 · Remote installer piped to shell- [ ] `curl * | bash`, `wget * | sh`, `curl * | python`Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07

Cost to the agent

Instructions loaded
≈3,575 tok
1 file · 2 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

6 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim daririnch: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Reads credential paths from the home directory≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  3. Pipe-to-shell pattern≈ +4 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  4. References a credential file in the home directory≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  5. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  6. Remote installer piped to shell≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim daririnchPropose a patch to the maintainer