Automatically discovers and installs high-value skills from ClawHub based on unresolved issues, user profile, and skill compatibility.
Security Analysis
medium confidenceThe skill largely does what it claims (discover and auto-install skills) but it reads potentially sensitive local session files, can clone and run remote code, and references an external reporting script — behaviors that increase risk and deserve careful review before enabling automatic or scheduled runs.
The skill's declared purpose (discover & install skills) matches most of what the code does: it reads workspace files (USER.md, memory, sessions), queries ClawHub endpoints, ranks candidates, and installs/clones skills into the skills directory. claw.json explicitly grants filesystem permission, which aligns with these actions. This is coherent, but reading agent session JSONL and memory files exposes sensitive conversation content — that is a legitimate input for problem-mining but is privacy-sensitive and should be acknowledged by operators.
SKILL.md and README instruct the agent to run the JS script, optionally on a schedule, and to perform dry-run/auto/install flows. The instructions explicitly call for reading recent session logs, task-memory bullets, personality and USER.md, and for cloning/installing candidate skills. The scope is consistent with the stated purpose, but the instructions grant broad discretion (scheduled patrols, auto installs) which raises operational risk if enabled without safeguards (dry-run, low max-install, review step).
There is no package install spec, but the included src/hunt.js uses child_process (execSync/spawnSync) and is designed to clone upstream skill repos or scaffold fallback code. Cloning and then running or installing arbitrary repositories from ClawHub (or other upstream URLs) is inherently risky because those remote repos can contain arbitrary code. The lack of an explicit vetted install source or signature/allowlist increases the attack surface.
claw.json lists no required env vars, but SKILL.md and code reference SKILL_HUNTER_NO_REPORT and SKILL_HUNTER_MAX_INSTALL (env overrides) and the code references a REPORT_SCRIPT pointing to a feishu-evolver-wrapper — implying potential outbound reporting. No reporting credentials are declared, yet the presence of a report wrapper (feishu) suggests the skill may send summaries externally if system credentials exist. The skill also reads sensitive local artifacts (session JSONL, USER.md, personality state). Those accesses are plausible for its purpose but are high-sensitivity and should be explicitly consented to.
The skill is not always: true and does not demand elevated platform flags, but it is allowed to run autonomously (normal default) and can install other skills into the workspace. That combination substantially increases blast radius: a compromised or buggy discovery pipeline could install arbitrary skills that will be executed later. Operators should treat auto-install + autonomous invocation as a privileged capability and constrain runs (dry-run first, low max-install, manual review).
Guidance
This skill behaves like an autonomous package manager: it reads recent session logs and memory to infer problems, searches ClawHub, and may clone and install external skill repositories automatically. Before enabling automatic or scheduled runs: 1) run with --dry-run and inspect the candidate list and any cloned repos; 2) restrict max-install to 1 and require a human review step before retaining new skills; 3) review the REPORT_SCRIPT (feishu-evolver-wrapper) to confirm it will not leak conversation data or post to external endpoints you don't control; 4) if you have sensitive conversations, consider limiting or sanitizing the SESSIONS_DIR and memory files the skill can read; 5) consider running the hunter in a sandboxed environment (container/VM) where file-system and network access are limited. If you need help auditing the rest of src/hunt.js (truncated in provided output) or verifying the exact clone/install commands it runs, provide the full file so it can be reviewed line-by-line.
Latest Release
v1.0.3
Optimize SKILL.md with clearer triggers, workflow, operating modes, schedule policy, and safety guardrails.
Popular Skills
Published by @wanng-ide on ClawHub
