ClawHub
Back to skill

Security audit

SWOT Analyzer

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward SWOT-analysis writing skill with disclosed web research and no code, persistence, credential use, or destructive behavior.

Installers should understand that the skill may use web search when available and that broad business-strategy prompts could invoke it. Avoid giving confidential business details unless you are comfortable having them used in the agent's analysis context.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The usage instructions are extremely broad ('run a SWOT analysis on anything' and 'the skill handles the rest'), which can cause an agent to invoke the skill in situations the user did not clearly intend. In agentic systems, ambiguous triggers can lead to unnecessary tool activation, unbounded context gathering or web research, and increased chance of acting on sensitive or irrelevant inputs.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger says the skill activates when a user asks for a SWOT analysis, competitive assessment, or strategic evaluation. While 'SWOT analysis' is specific, 'competitive assessment' and especially 'strategic evaluation' are broad business phrases that may overlap with ordinary conversation and lack clear boundaries or exclusion conditions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.