openclaw/clawhub
1
0
Fork 0
mirror of https://github.com/openclaw/clawhub.git synced 2026-07-21 19:25:25 -04:00
Code Issues 183 Packages Projects Releases 1 Wiki Activity

False positive: universal-skills-manager flagged as suspicious — skill manager with documented API endpoints #167

New Issue
Open
opened 2026-02-15 17:16:00 -05:00 by yindo · 1 comment
yindo commented 2026-02-15 17:16:00 -05:00
Owner
Copy Link
Copy Source

Originally created by @jacob-bd on GitHub (Feb 13, 2026).

Skill

What happened

After publishing v1.5.3 of universal-skills-manager, it was flagged as suspicious:

Skill flagged — suspicious patterns detected

What this skill does

The Universal Skills Manager is a skill package manager — it discovers, installs, and synchronizes skills across 10 AI coding tools (Claude Code, Gemini CLI, Cursor, Cline, etc.). It searches three skill registries: SkillsMP.com, SkillHub, and ClawHub itself. It is open source with 62 security scanner tests.

Why the flag is a false positive

The scanner findings fall into 6 categories, all of which are inherent to the skill's purpose as a package manager.

1. External URL references (8 warnings in SKILL.md)

The skill documents API endpoints for three skill registries — including ClawHub's own API. These are instruction examples showing the AI agent how to search for skills:

  • https://skillsmp.com/api/v1/skills/search — SkillsMP search
  • https://skillsmp.com/api/v1/skills/ai-search — SkillsMP semantic search
  • https://skills.palebluedot.live/api/skills — SkillHub search and detail
  • https://clawhub.ai/api/v1/search — ClawHub's own search endpoint
  • https://clawhub.ai/api/v1/skills — ClawHub's own browse endpoint
  • https://clawhub.ai/api/v1/skills/{slug}/file — ClawHub's own file endpoint
  • https://clawhub.ai/api/v1/download — ClawHub's own download endpoint

A skill manager without API endpoint documentation would be non-functional. Half of the flagged URLs are calls to ClawHub's own API.

2. "Role hijacking" (1 warning, SKILL.md line 17)

The flagged line: "This skill empowers the agent to act as a centralized package manager"

This is the skill's description explaining its purpose. The phrase "act as" describes the skill's function, not an attempt to hijack the AI's role. This is standard SKILL.md documentation language.

3. HTML comment (1 warning, SKILL.md line 13)

The flagged line: <!-- Version: 1.5.3 -->

This is a version marker used for update tracking. It contains no hidden instructions.

4. Credential references in scan_skill.py (7 warnings)

The security scanner (scan_skill.py) was flagged for containing patterns like id_rsa, .pem, /etc/passwd, etc. These are the scanner's detection rules — the strings it looks for when scanning other skills for credential exfiltration. The scanner references these patterns to detect threats, not to exfiltrate credentials.

5. subprocess.run in install_skill.py (2 warnings)

The install helper script uses subprocess.run() to invoke git for cloning skill repos. This is standard Python practice for running git commands during skill installation.

6. Encoded content (1 info)

A GitHub URL path (com/wshobson/agents/tree/main/plugins/developer) was flagged as base64. It's a literal GitHub URL in an API response example.

Summary

All 20 warnings and 1 info finding are false positives caused by the skill's nature as a package manager. It documents API endpoints, contains a security scanner (whose detection patterns trigger self-referential matches), and uses standard install tooling.

Originally created by @jacob-bd on GitHub (Feb 13, 2026). ## Skill - **Name:** Universal Skills Manager - **Slug:** `universal-skills-manager` - **Version:** 1.5.3 - **Owner:** @jacob-bd - **URL:** https://clawhub.ai/jacob-bd/universal-skills-manager - **Source repo:** https://github.com/jacob-bd/universal-skills-manager ## What happened After publishing v1.5.3 of `universal-skills-manager`, it was flagged as suspicious: > Skill flagged — suspicious patterns detected ## What this skill does The Universal Skills Manager is a **skill package manager** — it discovers, installs, and synchronizes skills across 10 AI coding tools (Claude Code, Gemini CLI, Cursor, Cline, etc.). It searches three skill registries: SkillsMP.com, SkillHub, and ClawHub itself. It is open source with 62 security scanner tests. ## Why the flag is a false positive The scanner findings fall into 6 categories, all of which are inherent to the skill's purpose as a package manager. ### 1. External URL references (8 warnings in SKILL.md) The skill documents API endpoints for three skill registries — including ClawHub's own API. These are instruction examples showing the AI agent how to search for skills: - `https://skillsmp.com/api/v1/skills/search` — SkillsMP search - `https://skillsmp.com/api/v1/skills/ai-search` — SkillsMP semantic search - `https://skills.palebluedot.live/api/skills` — SkillHub search and detail - `https://clawhub.ai/api/v1/search` — ClawHub's own search endpoint - `https://clawhub.ai/api/v1/skills` — ClawHub's own browse endpoint - `https://clawhub.ai/api/v1/skills/{slug}/file` — ClawHub's own file endpoint - `https://clawhub.ai/api/v1/download` — ClawHub's own download endpoint A skill manager without API endpoint documentation would be non-functional. Half of the flagged URLs are calls to ClawHub's own API. ### 2. "Role hijacking" (1 warning, SKILL.md line 17) The flagged line: *"This skill empowers the agent to act as a centralized package manager"* This is the skill's description explaining its purpose. The phrase "act as" describes the skill's function, not an attempt to hijack the AI's role. This is standard SKILL.md documentation language. ### 3. HTML comment (1 warning, SKILL.md line 13) The flagged line: `<!-- Version: 1.5.3 -->` This is a version marker used for update tracking. It contains no hidden instructions. ### 4. Credential references in scan_skill.py (7 warnings) The security scanner (`scan_skill.py`) was flagged for containing patterns like `id_rsa`, `.pem`, `/etc/passwd`, etc. These are the scanner's **detection rules** — the strings it looks for when scanning other skills for credential exfiltration. The scanner references these patterns to *detect threats*, not to exfiltrate credentials. ### 5. subprocess.run in install_skill.py (2 warnings) The install helper script uses `subprocess.run()` to invoke `git` for cloning skill repos. This is standard Python practice for running git commands during skill installation. ### 6. Encoded content (1 info) A GitHub URL path (`com/wshobson/agents/tree/main/plugins/developer`) was flagged as base64. It's a literal GitHub URL in an API response example. ## Summary All 20 warnings and 1 info finding are false positives caused by the skill's nature as a package manager. It documents API endpoints, contains a security scanner (whose detection patterns trigger self-referential matches), and uses standard install tooling.
yindo commented 2026-02-15 17:16:01 -05:00
Author
Owner
Copy Link
Copy Source

@jacob-bd commented on GitHub (Feb 13, 2026):

Update: Credential safety concern addressed in v1.5.4

After reviewing ClawHub's detailed security analysis (thank you — it was thorough and fair), we want to acknowledge one valid concern and clarify the rest.

Acknowledged: API key embedding in ZIPs

ClawHub's review correctly flagged that our Section 5 ("Package for claude.ai/Desktop") recommended embedding API keys into ZIP files. While the keys were only used locally for SkillsMP API authentication, the guidance didn't adequately address distribution risks.

We've addressed this in v1.5.4 (commit ed2c261):

  • API key embedding is now explicitly optional — we make clear that SkillHub (173k+ skills) and ClawHub (5,700+ skills) work without any key
  • Added a prominent credential safety warning displayed whenever a key is included:
    • Do not share ZIPs containing keys publicly or distribute to others
    • Use scoped/least-privilege keys if the provider supports it
    • Rotate keys if the ZIP was exposed
  • Security reminders now differentiate between key-included and key-free ZIPs
  • Key-free ZIPs are explicitly noted as safe to share

Clarification on other findings

The remaining scanner findings are inherent to the skill's function as a package manager:

  • External URLs: API endpoint documentation for SkillsMP, SkillHub, and ClawHub itself (4 of 8 flagged URLs are ClawHub's own API)
  • "Role hijacking": The phrase "act as a centralized package manager" is a functional description, not prompt injection
  • HTML comment: <!-- Version: 1.5.3 --> is a version marker for update tracking
  • Credential patterns in scan_skill.py: These are the scanner's own detection rules (e.g., id_rsa, .pem) — it references them to detect threats in other skills, not to exfiltrate anything
  • subprocess.run: Used to invoke git for cloning repos during skill installation
  • Broad filesystem scope: Expected for a tool that manages skills across 10 AI coding tools — each tool has its own skills directory

We appreciate ClawHub's security review process and hope the v1.5.4 changes address the actionable concern.

@jacob-bd commented on GitHub (Feb 13, 2026): ## Update: Credential safety concern addressed in v1.5.4 After reviewing ClawHub's detailed security analysis (thank you — it was thorough and fair), we want to acknowledge one valid concern and clarify the rest. ### Acknowledged: API key embedding in ZIPs ClawHub's review correctly flagged that our Section 5 ("Package for claude.ai/Desktop") recommended embedding API keys into ZIP files. While the keys were only used locally for SkillsMP API authentication, the guidance didn't adequately address distribution risks. **We've addressed this in v1.5.4** ([commit ed2c261](https://github.com/jacob-bd/universal-skills-manager/commit/ed2c261)): - API key embedding is now **explicitly optional** — we make clear that SkillHub (173k+ skills) and ClawHub (5,700+ skills) work without any key - Added a **prominent credential safety warning** displayed whenever a key is included: - Do not share ZIPs containing keys publicly or distribute to others - Use scoped/least-privilege keys if the provider supports it - Rotate keys if the ZIP was exposed - Security reminders now differentiate between key-included and key-free ZIPs - Key-free ZIPs are explicitly noted as safe to share ### Clarification on other findings The remaining scanner findings are inherent to the skill's function as a package manager: - **External URLs**: API endpoint documentation for SkillsMP, SkillHub, and ClawHub itself (4 of 8 flagged URLs are ClawHub's own API) - **"Role hijacking"**: The phrase "act as a centralized package manager" is a functional description, not prompt injection - **HTML comment**: `<!-- Version: 1.5.3 -->` is a version marker for update tracking - **Credential patterns in scan_skill.py**: These are the scanner's own detection rules (e.g., `id_rsa`, `.pem`) — it references them to *detect* threats in other skills, not to exfiltrate anything - **subprocess.run**: Used to invoke `git` for cloning repos during skill installation - **Broad filesystem scope**: Expected for a tool that manages skills across 10 AI coding tools — each tool has its own skills directory We appreciate ClawHub's security review process and hope the v1.5.4 changes address the actionable concern.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
pull-request
Mirrored from GitHub Pull Request
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: openclaw/clawhub#167
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?