ClawHub
Back to skill

Security audit

Agency Command Center

Security checks for vulnerabilities and agentic risk

Overview

This is a legitimate agency-operations skill, but it needs review because it normalizes collecting client access credentials without secure handling guidance.

Install only if you are comfortable using it as an agency-operations template and will handle client access through secure delegated methods such as SSO, role-based invites, password managers, or scoped temporary tokens. Do not use it to request or store plaintext client passwords in chat, email, or project notes.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Credential Access

High
Category
Privilege Escalation
Confidence
97% confidence
Finding

The phrase 'Access credentials collected' is a direct credential-access pattern and, in this business-operations context, is more dangerous because the skill operationalizes it as a standard onboarding step. Without controls, it can facilitate harvesting, storing, or mishandling sensitive credentials for multiple client environments, amplifying breach impact across organizations.

Content

Scanner excerpt · SKILL.md (reported line 356)May include surrounding context.

md
- [ ] Client added to communication channel
    
  day_1:
    - [ ] Access credentials collected (see access request template)
    - [ ] Onboarding questionnaire sent
    - [ ] Project timeline shared
    - [ ] Team introductions made

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The example trigger "Agency dashboard" is short and generic, with no constraints on context or exclusion conditions. In a markdown skill description, this can be interpreted as an overly broad activation phrase that may collide with common requests about dashboards rather than clearly scoping when the skill should activate.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The onboarding checklist explicitly instructs collection of client access credentials without any safety guidance, least-privilege requirements, or secure handling procedure. This normalizes asking for raw credentials and could lead users to transmit passwords or privileged secrets through insecure channels, exposing client systems to compromise.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The welcome email states that the agency will send access requests for client systems but provides no warning about verifying destination, scope, or method of granting access. In context, this can encourage unsafe provisioning practices and social-engineering-friendly workflows where users grant broad access without validation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill exposes broad natural-language triggers such as 'Growth plan', 'Capacity check', and 'Weekly update for [client]' that overlap with normal business conversation. In an agent environment, this can cause unintended invocation and execution of agency workflows from incidental user text or embedded content, especially if the agent auto-routes commands without explicit confirmation.

Content

No source excerpt is available for this finding.