ClawHub
Back to skill

Security audit

Business Automation Architect

Security checks for vulnerabilities and agentic risk

Overview

This skill is useful for planning business automations, but some examples can authorize payments, account changes, and recurring jobs without consistently requiring active human approval.

Install only if you will treat it as a planning aid and require explicit approval before any workflow touches payments, account creation, customer communications, production records, public posting, or recurring jobs. Use least-privilege credentials, dry runs, staging data, audit logs, duplicate checks, and timeout-to-escalation rather than timeout-to-approval for sensitive workflows.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill explicitly promotes implementing automations through APIs, scripts, cron jobs, and notifications, but provides no warning about risks to production systems, sensitive business data, or unintended side effects from autonomous changes. In a business automation context, these capabilities can directly affect live operations, making missing safety guidance materially dangerous even if the author's intent appears operational rather than malicious.

Vague Triggers

Medium
Confidence
83% confidence
Finding
The quick-start invocation phrases are broad and generic enough to match common business-assistance requests, which can cause the skill to activate outside clearly scoped automation-design contexts. Because the skill then guides implementation of workflows and automations, unintended activation could lead an agent to recommend or perform operational changes without explicit user intent or adequate safeguards.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The workflow examples include high-impact actions such as invoice auto-approval, payment scheduling, account creation, escalation handling, and auto-closing support tickets without consistently requiring human review or warning about operational and legal consequences. In a business automation skill, these examples are likely to be copied into real workflows, so the omission of guardrails materially increases the chance of harmful autonomous actions affecting finances, access control, or customer outcomes.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
→ Extract data (vendor, amount, line items, due date)
  → Match to PO / budget category
  → Validate:
    - Amount within approved range? → Auto-approve
    - Over threshold? → Route to manager
    - No matching PO? → Flag for review
  → Schedule payment based on terms
Confidence
96% confidence
Finding
The invoice-processing example explicitly recommends auto-approving invoices that fall within an approved range, which delegates a financially sensitive control to automation without specifying anti-fraud checks, segregation of duties, or mandatory audit review. In finance workflows, even bounded auto-approval can be abused through manipulated vendors, spoofed invoices, duplicate submissions, or incorrect matching logic, leading to unauthorized payments or compliance failures.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill gives implementation guidance for automations that perform API calls, use bearer tokens, send messages, schedule jobs, and write data to files, but it does not require explicit user confirmation, data-classification checks, or privacy/security warnings before handling business data. In this context, users may apply the templates directly to production workflows, which creates a realistic risk of unintended data exfiltration, insecure credential handling, or unsafe persistence of sensitive information.

External Transmission

Medium
Category
Data Exfiltration
Content
# Step 1: Fetch data
log "Fetching data from [source]..."
DATA=$(curl -s -H "Authorization: Bearer $API_TOKEN" \
  "https://api.example.com/endpoint")

# Step 2: Validate
if [ -z "$DATA" ]; then
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
on_reject: "notify_requestor_with_reason"
  on_timeout:
    - Escalate to next level
    - Or: auto-approve if amount < $10000
```

### Graceful Degradation
Confidence
98% confidence
Finding
The approval-gate example allows timeout-based auto-approval for amounts under $10,000, which can convert a missed response into an authorization event without active human consent. This is dangerous because approver unavailability, notification failures, or deliberate timing attacks could cause transactions to proceed silently, undermining approval controls and creating financial and governance risk.

Static analysis

No suspicious patterns detected.