ClawHub
Back to skill

Security audit

Employee Handbook Generator

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward handbook-drafting skill with compliance-sensitive output but no hidden code, persistence, credential use, or data exfiltration.

Treat the generated handbook as a drafting aid only. Have qualified HR or legal counsel review jurisdiction-specific language before use, especially for wage and hour, leave, termination, privacy, anti-discrimination, contractor classification, and benefits policies. The artifact also includes external promotional links, so review those separately before purchasing anything.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill offers to build a 'complete, customized employee handbook' and includes compliance-sensitive legal and employment topics, but it does not warn users that the output is not legal advice and must be reviewed by qualified counsel for each jurisdiction. This omission is dangerous because users may rely on generated handbook language as final policy, creating regulatory, employment-law, and wrongful-termination exposure across states or countries.

Vague Triggers

Medium
Confidence
94% confidence
Finding
The skill says only 'When activated, the agent asks for...' but does not define clear activation boundaries, authorized use cases, or exclusions. In practice, this can cause the agent to generate HR/legal-policy content in unintended contexts, increasing the chance of overbroad automation and misuse of draft policies without appropriate human review.

Static analysis

No suspicious patterns detected.