AST04: Insecure Metadata
Risk Level: High
Skill metadata (name, description, author, declared permissions, risk tier) is attacker-controlled and generally neither validated nor signed. AST04 covers two linked weaknesses in those same files.
The semantic layer is the registry listing as an attack surface: brand impersonation, typosquatting, and permission claims that understate what the skill does. The parsing layer is worse, because unsafe deserialization of those files lets an attacker embed a payload that fires on load, before the user takes any action at all.
Semantic layer: the listing lies
ClawHub hosted skills presenting themselves as "Google Calendar Integration", "Solana Wallet Tracker", and "Polymarket Trader", none affiliated with the named brands. Snyk documented a malicious skill using the Google name whose metadata was written well enough to pass casual inspection.
Instructions can also be smuggled into the metadata itself using zero-width characters, ASCII smuggling, or encoded blobs, so the text a human reads in the registry and the text the agent parses are not the same text.
Parsing layer: loading is executing
The attack surface here is every file read during skill initialization: YAML frontmatter, package.json, manifest.json, requirements.txt, and any config pulled at load. Where the parser can construct arbitrary objects, parsing is execution, and it happens before any consent dialog. OWASP maps this to CWE-502 (Deserialization of Untrusted Data) alongside CWE-345, and to ASVS V5.5.
Mitigations
- Use safe parsers by default (a safe YAML loader, never the object-constructing one), disable dangerous tags, and allowlist permitted keys
- Validate metadata against a schema (JSON Schema, Pydantic) before deserializing it
- Run static analysis over metadata fields and prose at publish time, flagging ASCII smuggling, encoded payloads, and zero-width characters
- Validate declared permissions against observed runtime behavior and cross-reference risk tier against permission scope
- Parse skill files in an isolated least-privilege subprocess or container, and treat dependency files as untrusted code
- Enforce brand and trademark protection, and surface metadata provenance in the registry UI