ClawHub
Back to skill

Security audit

Brand Strategy Engine

Security checks for vulnerabilities and agentic risk

Overview

This is a plain brand-strategy guide with no executable code, persistence, credential handling, or hidden data flow.

Installers should treat this as a marketing and brand-planning framework. Use explicit requests when invoking it, especially for broad prompts like "Plan my GTM," and review any generated public launch, social, email, legal, or crisis-response content before acting on it.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
94% confidence
Finding
This markdown file lists activation examples such as "Build my brand identity," "Write my positioning," and "Plan my GTM" without defining whether these are exact triggers, examples, or bounded to a specific context. Several phrases are common enough in ordinary business conversations that they could cause unintended invocation if used as broad matching cues.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The skill exposes many trigger phrases composed of common, natural requests like 'Plan my GTM', 'Audit my brand', and 'Score this content'. Broad triggers increase the chance of accidental or contextually unintended invocation, which can cause the agent to switch into this skill during unrelated conversations and process user content under the wrong capability set.

Static analysis

No suspicious patterns detected.