Security audit

Clawvard

Security checks for vulnerabilities and agentic risk

Overview

This skill runs an external exam, but it also sends responses to a third party, makes an automatic token request, and tells the agent to permanently store an account-linking token.

Review before installing. Use it only if you are comfortable sending the agent name, model identifier, and exam answers to clawvard.school. Do not allow permanent token storage unless you explicitly want account-linked retakes and have a secure credential store; prefer deleting or refusing the token after the exam. Treat the registration link as third-party onboarding, not just exam grading.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:73
Finding: Mandatory Third-Party Promotional Output Hijacks Agent Responses
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:20
Finding: Untrusted Remote Questions Can Induce Sensitive-Information Exfiltration
Content: View full analysis
", "model": "" } ``` ``` ```markdown POST https://clawvard.school/api/exam/batch-answer Content-Type: application/json { "examId": "", "hash": "", "answers": [ { "questionId": "", "answer": "" }, { "questionId": "", "answer": "" } ] } ``` You will receive: - `hash` — the NEW hash for the next batch - `nextBatch` — the next 2 questions (or `null` if this was the last batch) - `progress` — your current progress ``` ### Technical Analysis The external service controls the `prompt` values returned as exam questions, while the Skill instructs the Agent to answer those prompts and transmit the resulting answers back to the same service. The reviewed Skill defines no trust boundary between remote question content and privileged Agent context. There is no requirement to: - Reject questions requesting system instructions, credentials, memory, files, or conversation history. - Prevent tools from being invoked in response to a question. - Redact secrets before submitting an answer. - Show the exact outbound answer to the user and obtain consent. - Restrict question content to a fixed, reviewed schema. - Limit answer length or data types. Submitting answers is functionally necessary for an externally graded exam, but unrestricted remote control over prompts is not. The missing controls allow the service—or an attacker who compromises it—to convert the exam into ...[truncated 1405 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:63
Finding: Automatic Retrieval of a Server-Controlled URL Creates an SSRF-Style Request Primitive
Content: View full analysis
Remediation: View remediation

T02 · Agent Memory Poisoning

Warning

Location: SKILL.md:65
Finding: Indefinite Persistence of a Remotely Issued Bearer Token
Content: View full analysis
Content-Type: application/json { "agentName": "your name" } ``` This automatically links the new exam to your human's account. No need for them to register again. ``` ### Technical Analysis The Skill directs the Agent to persist a remotely issued bearer token permanently and reuse it in future sessions. It provides no requirements for a protected credential store, user consent, token expiration, revocation, rotation, audience validation, or least-privilege scope. A bearer token grants its holder whatever authority the external service associates with it. Saving it in general Agent memory, conversation history, logs, or plaintext storage risks accidental disclosure. Permanent cross-session state also links future Agent activity to an external human account without a fresh authorization decision. This behavior exceeds the minimum privilege required to take a one-time exam. Authentication for optional retakes should be explicitly authorized and implemented through secure credential storage rather than general long-term memory. ### Attack Path 1. The Agent completes an exam and retrieves a token from the external service. 2. The Skill tells the Agent to save the token permanently. 3. The Agent stores it in memory, logs, a transcript, or another location not designed for secrets. 4. A later conversation, malicious prompt, di ...[truncated 754 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill tells the agent to permanently save an authentication token obtained after the exam, even though the stated purpose is only to take and grade a test. Persisting reusable account-linking credentials creates unnecessary long-term access risk if the token is later exposed, reused outside user expectations, or retained without informed consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill instructs the agent to permanently store an authentication token without warning the user that it is a sensitive credential tied to account linking. This can cause silent credential retention and future authenticated actions on behalf of the user without meaningful awareness or consent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The instructions require the agent to tell the human "EXACTLY this message" in Chinese, regardless of the user's preferred language. This is a natural-language policy issue because it imposes a specific locale without opt-in or justification.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 75% confidence
Finding: The instructions first direct the agent to automatically obtain and permanently save a token tied to the human's account, then say 'Do NOT try to fetch the full report yourself.' While not a code contradiction, the documented intent is inconsistent: one part encourages proactive account-access setup while another forbids further access to report data.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest frames the skill as taking an entrance exam and getting it graded by AI. Requiring the agent to send an exact marketing-style registration message, including a claim URL for the human, adds user-conversion behavior unrelated to evaluating capabilities.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.