ClawHub
Back to skill

Security audit

Breakthrough Thinking

Security checks for vulnerabilities and agentic risk

Overview

This is a prompt-only thinking aid that may activate too broadly, but it does not install code, persist changes, access credentials, or create hidden data flows.

Install only if you want the assistant to automatically switch problem-solving frameworks when it appears stuck. Be aware that generic phrases like 'continue' or 'try another way' may trigger it unexpectedly, so review or narrow the trigger wording if you need precise control.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

Vague Triggers

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill is configured to auto-trigger on very common phrases such as 'continue', 'try another way', and '再想想', which can appear in ordinary conversation without the user intending to invoke a special control flow. Because invocation is mandatory and immediate, this can hijack the agent’s behavior and override normal user-consent or routing expectations, increasing the chance of unintended autonomous execution.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger phrases are common conversational inputs such as 'continue', 'rethink', and 'try another way', so the skill can activate during ordinary dialogue without the user explicitly consenting to this behavior. Because the skill is designed to auto-execute and alter the assistant's problem-solving flow, broad triggers create unintended control over assistant behavior and can interfere with higher-priority task boundaries or user expectations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Auto-activation when the AI is 'stuck' is underspecified, using subjective conditions like repeated failures or no new evidence, which can be interpreted inconsistently and trigger unexpectedly. This ambiguity gives the skill broad latitude to self-invoke, increasing the risk of unbounded behavior changes, looping between frameworks, or activation in contexts where the user did not request it.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The English trigger list includes very generic phrases like 'try another way', 'rethink', and 'continue', which are routine conversational language and likely to appear in many benign interactions. In a skill that auto-triggers and changes execution strategy, such unconstrained phrasing increases the chance of accidental invocation and prompt-surface abuse through indirect or embedded instructions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The top-level natural-language instructions are framed as mandatory Chinese directives, including a '强制调用指令', without offering the user any language or locale choice. This creates a language-policy concern because the skill imposes a specific locale context rather than explicitly making it optional or user-selected.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The implicit stall conditions are subjective and underspecified, for example '超过1轮无新证据' or 'suggesting manual work too early', which leaves activation to unstable internal judgment rather than clear policy. This can cause the skill to self-activate unpredictably, leading to repeated retries, unnecessary tool use, or bypass of safer clarification steps.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
88% confidence
Finding

The instruction 'Do not ask user for info until you've exhausted locally testable paths' pushes the agent toward autonomous decision-making and discourages clarification even when user input may be needed for safety, scope, or authorization. In context, this becomes more dangerous because the skill also auto-triggers and mandates repeated retries, which can compound unintended actions before the user can intervene.

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

md
- No "same approach + small tweak" twice in a row.
- Every retry must use a DIFFERENT mental model.
- Do not ask user for info until you've exhausted locally testable paths.
- Claims of completion must include evidence.
- If one model fails, immediately switch to another model. Do not get stuck on one framework.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The file content is entirely in Chinese and does not offer any language selection, fallback, or note that the skill is intentionally locale-specific. In this skill’s context, that matters because the skill is configured for forced invocation; users or downstream agents who do not read Chinese may be unable to understand its behavior, constraints, or outputs, increasing the risk of misuse, silent failure, or bypass of user intent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.