Agent Economy ReportAgent Economy ReportCAUTION version 1.0.1 · audited 2026-09-17
Skill Finder CN is a helper that searches the ClawHub registry and suggests skills to install. It does this by giving the agent shell commands to run a local clawhub program and to query clawhub.ai with curl. The package also includes a small bash script that forwards a search phrase and result limit to clawhub. The main risk is that it recommends installing other third-party skills, which can change what the agent can do; the package's own card warns about this. No hidden destinations, credential theft, payment redirection, obfuscation, or persistence mechanisms were found. Because it needs shell, network, and install abilities, this is rated CAUTION rather than SAFE.
Instructions try to steer the agent beyond the declared purpose. SKILL.md line 31 instructs clawhub search "<用户需求>" with a placeholder inserted into a double-quoted shell command. Double quotes do not prevent bash command substitution, so an agent performing naive substitution of untrusted user text could execute injected shell commands.
| Declared purpose | Skill 查找器 | Skill Finder. 帮助发现和安装 ClawHub Skills | Discover and install ClawHub Skills. |
| Observed behavior | The skill provides instructions and a helper script to run clawhub search, clawhub inspect, clawhub install, and clawhub list. It also instructs a curl request to https://clawhub.ai/api/v1/skills/<skill-name> and ls checks under ~/.openclaw/workspace/skills/. The helper script scripts/search.sh passes a query and limit to clawhub search. |
| Verdict, rules only | SAFE |
| Verdict, AI | CAUTION |
| Final verdict | CAUTION (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| network | needed | The skill queries the ClawHub API at https://clawhub.ai/api/v1/skills/<skill-name> using curl (SKILL.md line 43). |
| shell | needed | The skill requires bash and instructs shell commands including clawhub, curl, jq, and ls (SKILL.md lines 30-31, 36-37, 42-43, 48-49, 56-58, 66-67, 72-73). |
| filesystem_read | needed | It checks for installed skills by listing paths under ~/.openclaw/workspace/skills/ (SKILL.md lines 58 and 73). |
| filesystem_write | needed | The clawhub install command will write new skill files into the agent workspace (SKILL.md line 49). |
| install_packages | needed | The skill explicitly instructs installing third-party skills with clawhub install <skill-name> (SKILL.md line 49). |
| severity | finding |
|---|---|
| info | Declared purpose The metadata declares that this skill helps discover and install ClawHub skills. SKILL.md:3 description: "Skill 查找器 | Skill Finder. 帮助发现和安装 ClawHub Skills | Discover and install ClawHub Skills. 回答'有什么技能可以X'、'找一个技能' | Answers 'what skill can X', 'find a |
| info | Requires clawhub CLI The skill declares a dependency on the local clawhub binary. SKILL.md:9 bins: [clawhub] |
| medium | User input placed in a shell command The recommended command places a user-provided search phrase inside double quotes. In bash, double quotes still allow command substitution, so this pattern can be unsafe if an agent substitutes untrusted text without escaping shell metacharacters. SKILL.md:31 clawhub search "<用户需求>" |
| info | Network API call to ClawHub Fetches skill statistics from clawhub.ai. This is the only external domain used by the skill. SKILL.md:43 curl "https://clawhub.ai/api/v1/skills/<skill-name>" | jq '.skill.stats' |
| medium | Installs third-party skills The skill instructs installing other skills from ClawHub. Installing a third-party skill can change the agent's capabilities and is the main practical risk of this package. SKILL.md:49 clawhub install <skill-name> |
| info | Post-install filesystem check The skill verifies whether a skill manifest exists in the workspace after installation. SKILL.md:58 ls ~/.openclaw/workspace/skills/<skill-name>/SKILL.md |
| info | Search helper script The bundled script forwards its query and limit arguments to clawhub. The variables are quoted, which is safer than unquoted substitution. scripts/search.sh:15 clawhub search "$QUERY" --limit "$LIMIT" |
| info | Publisher acknowledges install risk The package's own risk note confirms that installing recommended third-party skills can alter what an agent can do. skill-card.md:25 Risk: Recommended third-party skill installs can change what an agent is able to do. |
| info | Advised mitigation The skill card advises reviewing and validating skills before installing them. The main SKILL.md workflow does not repeat this safety step. skill-card.md:27 Mitigation: Review the recommended skill, inspect its details, and scan or validate it before running any clawhub install command. |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| clawhub.ai | not in the service index | SKILL.md:43 |
| Binaries invoked | bash, curl |
| Environment variables read | LIMIT, QUERY |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 0 |
| base64 blobs | 0 |
| File writes | 3 |
| Persistence | 0 |
| file | lines | sha256 |
|---|---|---|
SKILL.md | 136 | 762005fbdc05a618… |
_meta.json | 6 | f99db1f5837a450a… |
package.json | 5 | 9245c1c9472bc37d… |
scripts/search.sh | 15 | 47d7986b5d616394… |
skill-card.md | 55 | f95cb75163fbd9e2… |
For agents
JSON: https://agenteconomy.report/k/skill-finder-cn.audit.json · badge: https://agenteconomy.report/k/skill-finder-cn.audited.svg ·
skill rating: /k/skill-finder-cn · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: the Agent Economy Report (free program: the 150 most downloaded skills, September 2026).