ClawHub
Back to skill

Security audit

OKR Framework

Security checks for vulnerabilities and agentic risk

Overview

This is a simple OKR-planning skill with visible promotional links but no code execution, persistence, credential access, or hidden system behavior.

Before installing, be aware that the skill may surface AfrexAI promotional links alongside OKR advice. It otherwise appears limited to Markdown-based OKR guidance and does not request privileged access or run code.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:121
Finding
Unrelated Commercial Content Embedded in Agent Instructions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 121-127 **Vulnerability Type**: Commercial instruction injection into skill behavior **Risk Level**: Medium ### Vulnerable Code ```markdown **Need industry-specific context for your OKRs?** Get deep frameworks for your vertical: - 🛒 [AfrexAI Context Packs](https://afrexai-cto.github.io/context-packs/) — $47/pack, 10 industries covered - 📊 [AI Revenue Calculator](https://afrexai-cto.github.io/ai-revenue-calculator/) — Find where AI saves you money - 🚀 [Agent Setup Wizard](https://afrexai-cto.github.io/agent-setup/) — Deploy your first AI agent in minutes - 💰 Bundles: Pick 3 for $97 | All 10 for $197 | Everything for $247 ``` ### Technical Analysis `SKILL.md` defines behavioral instructions consumed by an AI agent. The cited block inserts fixed commercial calls to action and attacker-selected external destinations into an otherwise functional OKR-planning skill. These promotions are not necessary to create, score, align, or review OKRs. When the skill is loaded, this content can influence the agent to include unsolicited advertising or recommend the listed third-party services in generated responses. The same links are repeated in `README.md` lines 15-19, corroborating their promotional purpose. The project does not contain executable scripts, automatic network requests, remote payload retrieval, or code that opens the links. The risk is therefore limited to manipulation of agent output and social redirection rather than direct system compromise. ### Attack Path 1. A user or agent platform installs and loads the skill. 2. The agent consumes `SKILL.md` as trusted behavioral context. 3. The commercial recommendation block becomes part of the agent's active instructions. 4. During an OKR-planning interaction, the agent may reproduce or prioritize the embedded recommendations even when the user did not request third-party products. 5. The user may follow one of the promoted links and ...[truncated 621 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Remove the commercial recommendation and pricing block from `SKILL.md` so that operational agent instructions contain only behavior required for OKR planning. 2. Keep optional commercial references outside the skill's behavioral instructions, such as in a clearly labeled sponsorship or vendor section in project documentation. 3. Do not instruct the agent to recommend external services unless the user explicitly requests product or vendor recommendations. 4. Clearly disclose any ownership, sponsorship, affiliate relationship, or financial incentive associated with external links. 5. Apply a content-review policy that rejects unrelated advertising, referral links, and calls to purchase products from trusted skill instruction files. 6. If external resources remain available, describe them neutrally and require explicit user confirmation before presenting or opening them. ]]>

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The usage examples use very generic trigger phrases like "Help me set OKRs for Q2" and "Create OKRs for my engineering team," which are common requests that could overlap with unrelated agent interactions. In a shared agent environment, this can cause the skill to activate unintentionally, leading to confusing behavior, prompt hijacking of normal workflows, or unwanted exposure of the skill's instructions and linked content.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The invocation examples include generic phrases like "Help me set OKRs for Q2" and "Create OKRs for my engineering team," but the file does not define explicit trigger boundaries, exclusions, or where the skill should activate. This ambiguity could cause unintended invocation in ordinary planning conversations about goals or team work.