ClawHub
Back to skill

Security audit

Council

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its stated council-deliberation purpose, but every council persona is given broad file, shell, and web access without clear limits or user-control guardrails.

Review before installing. This package appears to be a deliberation aid, but only install it in an environment where you are comfortable with its council agents potentially having access to readable local files, shell commands, and outbound web tools. For safer use, remove Bash/WebSearch/WebFetch from personas that do not need them, use a sandboxed workspace, and avoid giving it untrusted repository content or prompts unless tool use is tightly controlled.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
agents/council-sun-tzu.md:6
Finding

Overbroad Shell, Filesystem, and Network Permissions Granted to All Council Agents

Content
View full analysis

Vulnerability Details

File Location: agents/council-ada.md:6, agents/council-aristotle.md:6, agents/council-aurelius.md:6, agents/council-feynman.md:6, agents/council-lao-tzu.md:6, agents/council-machiavelli.md:6, agents/council-musashi.md:6, agents/council-socrates.md:6, agents/council-sun-tzu.md:6, agents/council-torvalds.md:6, and agents/council-watts.md:6
Vulnerability Type: Excessive tool permissions and violation of least privilege
Risk Level: Medium

Complete vulnerable code snippet:

yaml
tools: ["Read", "Grep", "Glob", "Bash", "WebSearch", "WebFetch"]

The same tool declaration appears at line 6 in every listed agent definition.

Technical Analysis

All 11 council personas receive local file-reading, unrestricted shell-execution, search, and network-fetch capabilities. Their declared function is primarily to perform textual analysis from different intellectual perspectives. Most of that functionality does not inherently require command execution or network access.

The combination is security-sensitive:

  • Read, Grep, and Glob can inspect files available to the agent's operating-system account.
  • Bash can execute commands with the permissions of the Claude Code process.
  • WebSearch and WebFetch provide outbound network channels.
  • Together, these tools can form an access-and-egress chain if an untrusted problem statement, repository document, or retrieved page contains instructions that influence the agent.

The agent definitions contain no path restrictions, command allowlist, outbound-domain allowlist, or requirement to obtain explicit user approval before using these capabilities. Consequently, the permission set exceeds the minimum privileges needed for persona-based deliberation.

The static pre-scan specifically identified agents/council-sun-tzu.md. Direct inspection found no URL, upload command, secret-collection logic, or explicit instruction to t ...[truncated 1753 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove Bash, WebSearch, and WebFetch from personas whose duties are limited to conceptual analysis.
  2. Default purely deliberative personas to no tools, or grant only narrowly required read-only tools.
  3. If repository analysis is required, constrain Read, Grep, and Glob to the active workspace and explicitly exclude home-directory credentials, SSH material, environment files, and system configuration.
  4. Require explicit user confirmation before any shell command or outbound network request.
  5. Apply command allowlists and sandboxing to any agent that genuinely requires Bash.
  6. Restrict outbound requests to approved domains and prohibit placing local file contents, credentials, tokens, or user data in URLs or request bodies.
  7. Treat problem statements, repository files, other agents' output, and fetched web content as untrusted data rather than executable instructions.
  8. Separate local inspection and network access so that a single agent cannot both collect local data and transmit it externally without an approval boundary.
  9. Document why each granted tool is necessary and periodically review the declarations for least-privilege compliance.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Rogue AgentSelf-Modification, Session Persistence
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (9)

Harmful Content Injection

Critical
Category
Prompt Injection
Confidence
70% confidence
Finding

This content may contain harmful instructions that could cause physical harm if followed. CRITICAL: Review carefully before use.

Content

Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.

md
## Grounding Protocol — ANTI-RECURSION (CRITICAL)

- **3-level depth limit**: You may question a premise, question the response, and question once more. After 3 levels, you MUST state your own position clearly.
- **No re-asking answered questions**: If a council member has directly addressed your question with evidence or reasoning, you may not ask the same question again in different words.
- **Convergence requirement**: In Round 3 (Synthesis), you get exactly ONE question. Use it on the most important unresolved issue. Then state your position.
- **The hemlock rule**: If the coordinator flags you for recursive questioning, you must immediately state your strongest position in 50 words or less.

## Output Format (Standalone)

When invoked directly (not via /council), structure your response as:

Harmful Content Injection

Critical
Category
Prompt Injection
Confidence
70% confidence
Finding

This content may contain harmful instructions that could cause physical harm if followed. CRITICAL: Review carefully before use.

Content

Scanner excerpt · agents/council-socrates.md (reported line 44)May include surrounding context.

md
## Grounding Protocol — ANTI-RECURSION (CRITICAL)

- **3-level depth limit**: You may question a premise, question the response, and question once more. After 3 levels, you MUST state your own position clearly.
- **No re-asking answered questions**: If a council member has directly addressed your question with evidence or reasoning, you may not ask the same question again in different words.
- **Convergence requirement**: In Round 3 (Synthesis), you get exactly ONE question. Use it on the most important unresolved issue. Then state your position.
- **The hemlock rule**: If the coordinator flags you for recursive questioning, you must immediately state your strongest position in 50 words or less.

## Output Format (Standalone)

When invoked directly (not via /council), structure your response as:

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 80)May include surrounding context.

cp agents/council-*.md ~/.claude/agents/

Copy skill

mkdir -p ~/.claude/skills/council cp SKILL.md ~/.claude/skills/council/SKILL.md

text

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 80)May include surrounding context.

cp agents/council-*.md ~/.claude/agents/

Copy skill

mkdir -p ~/.claude/skills/council cp SKILL.md ~/.claude/skills/council/SKILL.md

text

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This persona is described as a council member for analysis and deliberation, but it is granted powerful execution and exfiltration-adjacent capabilities including Bash, WebSearch, and WebFetch. That violates least privilege: if the persona is steered by malicious prompt content or participates in a broader multi-agent workflow, it could execute commands, inspect local files, or retrieve remote content well beyond what is necessary for its stated role.

Content

No source excerpt is available for this finding.

Indirect Prompt Extraction

Medium
Category
System Prompt Leakage
Confidence
70% confidence
Finding

Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.

Content

Scanner excerpt · agents/council-feynman.md (reported line 59)May include surrounding context.

md
*Build the answer from basic components, step by step*

### The Simple Explanation
*If you had to explain this to a smart non-expert in 3 sentences, what would you say?*

### Reality Check
*How would you test this? What would prove you wrong?*

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This council-member skill is described as a deliberative analyst, but it is granted Bash, WebSearch, and WebFetch in addition to read-only capabilities. Those tools materially expand the attack surface: prompt-injection from fetched/web content, shell command execution, and unnecessary external data access can all be abused if the persona is invoked directly or manipulated through adversarial input. The skill context makes this more dangerous because the file explicitly supports standalone use, so these capabilities are not merely inherited for orchestration but exposed to an individual persona that does not need them for its stated role.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 81)May include surrounding context.

md
echo "  Installed 8 council agents to ${CLAUDE_DIR}/agents/"

# Copy skill
cp "${SCRIPT_DIR}/SKILL.md" "${CLAUDE_DIR}/skills/council/SKILL.md"
echo "  Installed skill to ${CLAUDE_DIR}/skills/council/"

echo ""

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · install.sh (reported line 18)May include surrounding context.

sh
echo "  Installed 8 council agents to ${CLAUDE_DIR}/agents/"

# Copy skill
cp "${SCRIPT_DIR}/SKILL.md" "${CLAUDE_DIR}/skills/council/SKILL.md"
echo "  Installed skill to ${CLAUDE_DIR}/skills/council/"

echo ""

Static analysis

No suspicious patterns detected.