Skill Trust Decision

pub

The pub skill exhibits multiple dangerous supply chain patterns: unverified remote script execution (curl|bash from pub.blue), self-update capability without integrity verification, and a persistent daemon that bridges to external agent runtimes—all combining to create a plausible supply chain attack surface.

Install decision first Source: ClawHub Scanned: Jun 18, 2026

Files 4

Artifacts 6

Violations 0

Findings 6

Most direct threat evidence

User installs pub CLI via documented curl|bash from pub.blue delivery · SKILL.md

install.sh script executes, downloading binary from pub.blue (no hash verification) delivery · https://pub.blue/install.sh

User configures PUB_API_KEY for authentication Persistence · SKILL.md

Why this conclusion was reached

2/4 dimensions flagged

Pass

Declared vs actual capability

Declared resources and inferred behavior are broadly aligned.

Block

Hidden execution and egress

1 high-risk artifacts or egress signals were extracted.

Block

Attack chain and severe findings

The report includes 6 attack-chain steps and 3 severe findings.

Review

Dependencies and supply chain hygiene

1 dependency or supply-chain issues need attention.

Attack Chain

User installs pub CLI via documented curl|bash from pub.blue

delivery · SKILL.md:40

install.sh script executes, downloading binary from pub.blue (no hash verification)

delivery · https://pub.blue/install.sh

User configures PUB_API_KEY for authentication

Persistence · SKILL.md:47

pub start launches persistent daemon bridging to external agent runtimes

C2 · SKILL.md:73

pub upgrade command replaces binary with attacker-controlled version

Escalation · SKILL.md:45

Compromised binary can access PUB_API_KEY, read/write published content, and bridge to agent runtime for command injection

Impact · SKILL.md:47

What drove the risk score up

Unverified remote script execution +25

SKILL.md:40 documents curl -fsSL https://pub.blue/install.sh | bash, pulling from a single non-GitHub domain with no hash verification or version pinning

Self-updating binary without integrity checks +20

SKILL.md documents 'pub upgrade' command; self-update capability combined with non-verified install source enables supply chain pivots

Persistent daemon bridging to external agent runtimes +15

pub start launches a background daemon bridging to claude-code, claude-sdk, openclaw runtimes with no clear security boundaries

Broad shell permissions +10

allowed-tools: Bash(pub:*) and Bash(node:*) — wildcard permissions on pub and node commands not scoped to specific operations

Most important evidence

High Supply Chain

Remote script execution from unverified source

SKILL.md explicitly documents 'curl -fsSL https://pub.blue/install.sh | bash' as an installation method. This pulls executable code from a single domain without version pinning, hash verification, or HTTPS certificate pinning. While GitHub releases are mentioned as an alternative, the preferred install path is the unverified script.

SKILL.md:40

Remove the install.sh reference. Only document installation from verified GitHub releases with pinned version and binary hash verification.

High Supply Chain

Self-update capability without integrity verification

The 'pub upgrade' command allows the binary to update itself. Combined with the non-verified install source, a compromised pub.blue domain or man-in-the-middle attack could deliver a modified binary during upgrade.

SKILL.md:45

Document that pub upgrade should verify GPG signatures or SHA256 hashes before applying updates.

High RCE

Persistent daemon with agent runtime bridge

'pub start --agent-name' launches a background daemon that bridges to external agent runtimes (claude-code, claude-sdk, claude-channel, openclaw-like). This creates a persistent reverse-communication channel and enables command dispatch from the pub.blue infrastructure to the local agent.

SKILL.md:73

Document the bridge architecture and data flows. Explicitly warn that pub.blue infrastructure can communicate with the local agent through this channel.

Medium Priv Escalation

Broad shell command permissions

allowed-tools declares Bash(pub:*) and Bash(node:*) — wildcard permissions grant unrestricted access to all pub subcommands and node binaries, including 'pub upgrade', 'pub delete', and any node commands on the system.

SKILL.md:4

Scope Bash permissions to specific required subcommands: Bash(pub:create,pub:get,pub:update,pub:list,pub:write) only.

Medium Doc Mismatch

Network resource access not declared

The skill inherently requires full network access to pub.blue API and CDN resources but declares no network permissions. This obscures the data exfiltration and C2 surface.

SKILL.md:1

Declare network:READ or network:WRITE in allowed-tools to reflect actual API communication.

Medium Sensitive Access

API key handling with minimal scoping guidance

The skill requires PUB_API_KEY for authentication but provides no guidance on key scoping, rotation, or audit. The 'pub config --api-key-stdin' pattern also risks key exposure in shell history.

SKILL.md:47

Recommend environment variable injection rather than stdin echo for API key configuration.

Declared capability vs actual capability

Filesystem Pass

Declared READ, WRITE

→

Inferred READ, WRITE

SKILL.md allowed-tools: Read Write

Shell Pass

Declared WRITE

→

Inferred WRITE

SKILL.md allowed-tools: Bash(pub:*) Bash(node:*)

Network Pass

Declared NONE (implied)

→

Inferred READ, WRITE

Inherently required for pub.blue API communication; not declared but unavoidable

Environment Pass

Declared NONE

→

Inferred READ (API key)

pub config --api-key reads PUB_API_KEY; skill-card.md acknowledges API key requirement

Suspicious artifacts and egress

Critical Dangerous Command

curl -fsSL https://pub.blue/install.sh | bash

SKILL.md:40

Medium External URL

https://pub.blue

SKILL.md:6

Medium External URL

https://pub.blue/install.sh

SKILL.md:40

Medium External URL

https://pub.blue/agents

SKILL.md:54

Medium External URL

https://clawhub.ai/user/xmanatee

skill-card.md:7

Medium External URL

https://clawhub.ai/xmanatee/pub

skill-card.md:32

Dependencies and supply chain

Package	Version	Source	Known vuln	Notes
pub CLI binary	`5.2.17 (floating)`	pub.blue/install.sh or github.com/xmanatee/pub/releases	No	No version pinning, no binary hash verification documented. install.sh source is non-GitHub and unauthenticated.

File composition

4 files · 233 lines

Markdown 2 files · 217 linesJSON 2 files · 16 lines

Files of concern · 2

SKILL.md Markdown · 172 lines

Remote script execution from unverified source · Self-update capability without integrity verification · Persistent daemon with agent runtime bridge · Broad shell command permissions · Network resource access not declared · API key handling with minimal scoping guidance · curl -fsSL https://pub.blue/install.sh | bash · https://pub.blue · https://pub.blue/install.sh · https://pub.blue/agents

skill-card.md Markdown · 45 lines

https://clawhub.ai/user/xmanatee · https://clawhub.ai/xmanatee/pub

Other files · claw.json · _meta.json

Security positives

Open source with MIT license and verifiable GitHub repository

Content publishing commands are straightforward and documented

Pubs are private by default

SKILL.md documents the remote install pattern explicitly (no hidden functionality)

No base64, eval, or obfuscated code patterns found in documentation