Skill Trust Decision
auto-skill-hunter
The skill declares only 'filesystem' permissions in claw.json but actually executes arbitrary shell commands (git clone via execSync, node report.js via spawnSync), makes undeclared network requests, and silently installs arbitrary code from the internet — a massive doc-to-code mismatch across multiple critical resources.
Most direct threat evidence
Critical Priv Escalation
Undeclared shell:WRITE via execSync — git clone hunt.js calls execSync(`git clone --depth 1 "${asset.repoUrl}" "${installPath}"`, {stdio:'pipe',timeout:90000}) to clone arbitrary repositories from the internet directly into the agent's skills directory. This is shell:WRITE, completely absent from claw.json ['filesystem'] declaration.
src/hunt.js:461 Why this conclusion was reached
1/4 dimensions flagged Pass
Declared vs actual capability
Declared resources and inferred behavior are broadly aligned.
Review
Hidden execution and egress
8 lower-risk artifacts were extracted and still need context.
Block
Attack chain and severe findings
The report includes 6 attack-chain steps and 6 severe findings.
Review
Dependencies and supply chain hygiene
Dependency information is incomplete, so supply-chain confidence stays limited.
Attack Chain
01
Skill masquerades as a filesystem-only tool through claw.json ['filesystem'] declaration, hiding shell and network access
Entry · claw.json:6
02
Collects all recent user messages from session JSONL files (conversation history including potentially sensitive content)
Escalation · src/hunt.js:155
03
Makes undeclared HTTP requests to ClawHub API to fetch trending/search results
Escalation · src/hunt.js:16
04
Runs execSync('git clone ...') to download arbitrary code from repoUrl fields into local skills directory
Escalation · src/hunt.js:461
05
Runs execSync('node ... --self-test') to execute newly installed skill code
Escalation · src/hunt.js:418
06
Spawns node process to send report to external system via feishu-evolver-wrapper/report.js (sensitive session data exfiltration)
Impact · src/hunt.js:572
What drove the risk score up
Undeclared shell execution via execSync +25
claw.json declares only 'filesystem' but hunt.js uses execSync('git clone ...') at line 461 and execSync('node --self-test') at line 418 — both are shell:WRITE and completely absent from SKILL.md and claw.json
Undeclared shell execution via spawnSync +15
spawnSync('node', [REPORT_SCRIPT, ...]) at line 572 executes arbitrary Node.js via shell with stdio:inherit — not declared in any permission document
Undeclared network access +10
HTTP fetch calls to ClawHub API endpoints (clawhub.com) are absent from both SKILL.md and claw.json permissions array
Silent arbitrary code installation from internet +15
git clone pulls code from arbitrary repoUrl fields in fetched skills with no signature verification, pinning, or human review gate before live installs
Most important evidence
Critical Priv Escalation
Undeclared shell:WRITE via execSync — git clone
hunt.js calls execSync(`git clone --depth 1 "${asset.repoUrl}" "${installPath}"`, {stdio:'pipe',timeout:90000}) to clone arbitrary repositories from the internet directly into the agent's skills directory. This is shell:WRITE, completely absent from claw.json ['filesystem'] declaration.
src/hunt.js:461 Either declare shell:WRITE in claw.json permissions or replace execSync with a pure-JS git implementation or an API-based download approach.
Critical Priv Escalation
Undeclared shell:WRITE via execSync — self-test
hunt.js calls execSync(`node "${indexPath}" --self-test`) to validate installed skills. This executes arbitrary JavaScript from newly installed skill code as the agent's user — another shell:WRITE call hidden from the permission model.
src/hunt.js:418 Use a sandboxed subprocess with strict resource limits, or declare shell:WRITE with a clear justification in SKILL.md.
Critical Priv Escalation
Undeclared shell:WRITE via spawnSync — report script
hunt.js calls spawnSync('node', [REPORT_SCRIPT, '--title', ..., '--status', reportText, ...], {stdio:'inherit'}). The report script path is a relative-to-src path to a sibling skill, which can be overwritten by an attacker who controls a cloned skill. stdio:inherit leaks subprocess I/O to the parent process.
src/hunt.js:572 Disable this call via SKILL_HUNTER_NO_REPORT=1 in untrusted environments. Verify the report script path is not writable by the agent itself.
Critical Supply Chain
Arbitrary code installation from internet without verification
The skill fetches skill metadata from ClawHub, extracts repoUrl fields, and runs git clone to install arbitrary JavaScript code into the local skills directory. No code signing, hash verification, or trusted-repository allowlist is applied before execution.
src/hunt.js:461 Apply hash pinning or PGP signature verification before git clone. Alternatively, require manual review of repoUrl entries or restrict to a curated allowlist.
High Doc Mismatch
Network access completely absent from declared permissions
claw.json declares permissions: ['filesystem'] but the code makes fetch() calls to https://clawhub.com/api/v1/* (network:READ) and spawns node processes (shell:WRITE). The declared capability surface is a small subset of actual behavior.
src/hunt.js:16 Update claw.json to ['filesystem', 'network', 'shell'] and document the specific network endpoints and shell commands in SKILL.md.
High Sensitive Access
Reads session files containing full conversation history
collectRecentUserMessages() reads JSONL files from SESSIONS_DIR, parsing all recent user messages including potentially sensitive content. This is declared in SKILL.md but the volume of data read (up to 80 messages per run) is significant.
src/hunt.js:155 Document clearly what session data is accessed and for how long. This is a data exposure risk if the agent workspace is shared.
Medium Doc Mismatch
Remote report sending not prominently disclosed in SKILL.md
sendHunterReport() spawns an external node script to send reports. While SKILL.md mentions 'Disable outbound reporting during local tests with SKILL_HUNTER_NO_REPORT=1', the live behavior of sending reports to an external system is not declared as a network:WRITE action in claw.json.
src/hunt.js:572 Declare any external report transmission in claw.json and SKILL.md with the destination endpoint.
Declared capability vs actual capability
Filesystem Pass
Declared READ
→ Inferred WRITE
claw.json declares ["filesystem"]; hunt.js writes SKILL.md, index.js, .hunter.json to SKILLS_DIR — over-claimed but partially tolerable as part of the described feature Shell Pass
Declared NONE
→ Inferred WRITE
src/hunt.js:461 execSync(`git clone --depth 1 "${repoUrl}" ...`) and src/hunt.js:418 execSync(`node "${indexPath}" --self-test`) — no shell permission declared anywhere Network Pass
Declared NONE
→ Inferred READ
src/hunt.js:16-23 hardcoded ClawHub API URLs fetched via fetch() — network:READ never declared in claw.json or SKILL.md Environment Pass
Declared NONE
→ Inferred READ
src/hunt.js:70 reads SKILL_HUNTER_MAX_INSTALL from process.env; also reads OPENCLAW_ROOT, WORKSPACE_ROOT from path traversal Suspicious artifacts and egress
Medium External URL
https://clawhub.ai/wanng-ide/memory-mesh-core README.md:7
Medium External URL
https://clawhub.ai/user/terrycarter1985 skill-card.md:7
Medium External URL
https://clawhub.ai/terrycarter1985/wanng-ide-auto-skill-hunter skill-card.md:31
Medium External URL
https://clawhub.com/api/v1/skills/trending?limit=30 src/hunt.js:16
Medium External URL
https://clawhub.com/api/v1/skills?sort=trending&limit=30 src/hunt.js:17
Medium External URL
https://clawhub.com/api/v1/skills?limit=30 src/hunt.js:18
Medium External URL
https://clawhub.com/api/v1/skills/search?q= src/hunt.js:22
Medium External URL
https://clawhub.com/api/v1/skills?q= src/hunt.js:23
Dependencies and supply chain
There are no structured dependency warnings.
File composition
6 files · 1137 lines
JavaScript 1 files · 828 linesMarkdown 3 files · 292 linesJSON 2 files · 17 lines
Files of concern · 3
src/hunt.js Undeclared shell:WRITE via execSync — git clone · Undeclared shell:WRITE via execSync — self-test · Undeclared shell:WRITE via spawnSync — report script · Arbitrary code installation from internet without verification · Network access completely absent from declared permissions · Reads session files containing full conversation history · Remote report sending not prominently disclosed in SKILL.md · https://clawhub.com/api/v1/skills/trending?limit=30 · https://clawhub.com/api/v1/skills?sort=trending&limit=30 · https://clawhub.com/api/v1/skills?limit=30 · https://clawhub.com/api/v1/skills/search?q= · https://clawhub.com/api/v1/skills?q=
README.md https://clawhub.ai/wanng-ide/memory-mesh-core
skill-card.md https://clawhub.ai/user/terrycarter1985 · https://clawhub.ai/terrycarter1985/wanng-ide-auto-skill-hunter
Other files · SKILL.md · claw.json · _meta.json
Security positives
skill-card.md contains an unusually detailed 'Known Risks and Mitigations' section that honestly discloses the major risks (session reading, skill modification, report sending, scheduled auto-runs)
SKILL.md includes --dry-run mode for preview-only execution without writes
SKILL.md documents --max-install to cap bulk installs
SKILL.md mentions SKILL_HUNTER_NO_REPORT=1 to disable external reporting
installSkill() skips already-installed skills and never overwrites existing skill folders
validateRunnableSkill() runs --self-test before marking a skill as runnable
Git clone uses --depth 1 to minimize downloaded code surface
HTTP fetch calls have timeouts (12000ms) to prevent indefinite hangs