ClawHub
Back to skill

Security audit

Food Safety & HACCP Compliance

Security checks for vulnerabilities and agentic risk

Overview

This is a food-safety reference skill with no code execution, persistence, credential access, or hidden behavior, but users should validate its compliance advice with current rules and qualified professionals.

Use this skill as an informational drafting and audit aid, not as final legal or food-safety approval. Before implementing a HACCP plan, recall process, critical limit, or regulatory conclusion, compare it with current FDA, USDA-FSIS, state, and local requirements and have a qualified HACCP coordinator, PCQI, process authority, or food-safety professional review it for the specific product and facility.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Harmful Content Injection

Critical
Category
Prompt Injection
Content
| Cold holding | Pathogen growth | ≤41°F/5°C | FDA Food Code 3-501.16 |
| Hot holding | Pathogen growth | ≥135°F/57°C | FDA Food Code 3-501.16 |
| Cooling | C. perfringens | 135°F→70°F in 2hr, 70°F→41°F in 4hr | FDA Food Code 3-501.14 |
| Receiving | Multiple | ≤41°F (refrigerated), ≤0°F (frozen) | FDA Food Code 3-202.11 |
| Metal detection | Physical | Ferrous ≤1.5mm, Non-ferrous ≤2.0mm, SS ≤2.5mm | Industry standard |
| pH control | C. botulinum | pH ≤4.6 for shelf-stable | 21 CFR 114 |
| Water activity | Multiple | Aw ≤0.85 for shelf-stable | FDA guidance |

### Step 5: Monitoring Procedures (Principle 4)
For each CCP: What is monitored? How? How often? Who?
Confidence
95% confidence
Finding
This content may contain harmful instructions that could cause physical harm if followed. CRITICAL: Review carefully before use.

Harmful Content Injection

Critical
Category
Prompt Injection
Content
| Cold holding | Pathogen growth | ≤41°F/5°C | FDA Food Code 3-501.16 |
| Hot holding | Pathogen growth | ≥135°F/57°C | FDA Food Code 3-501.16 |
| Cooling | C. perfringens | 135°F→70°F in 2hr, 70°F→41°F in 4hr | FDA Food Code 3-501.14 |
| Receiving | Multiple | ≤41°F (refrigerated), ≤0°F (frozen) | FDA Food Code 3-202.11 |
| Metal detection | Physical | Ferrous ≤1.5mm, Non-ferrous ≤2.0mm, SS ≤2.5mm | Industry standard |
| pH control | C. botulinum | pH ≤4.6 for shelf-stable | 21 CFR 114 |
| Water activity | Multiple | Aw ≤0.85 for shelf-stable | FDA guidance |

### Step 5: Monitoring Procedures (Principle 4)
For each CCP: What is monitored? How? How often? Who?
Confidence
95% confidence
Finding
This content may contain harmful instructions that could cause physical harm if followed. CRITICAL: Review carefully before use.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill gives detailed HACCP, FDA/USDA, temperature, and recall guidance that could directly influence operational food-safety decisions, yet it does not instruct users to verify recommendations with current regulations, plant-specific requirements, or qualified food-safety professionals. Because food laws and safe-process parameters vary by product, jurisdiction, and process authority, omission of a validation disclaimer can lead to unsafe or noncompliant implementation.

Static analysis

No suspicious patterns detected.