ClawHub
Back to skill

Security audit

Model Brain

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed model-routing skill, but its rules can send wallet signing or transfer requests to a low-scrutiny zero-LLM path, even when high-stakes routing is requested.

Review before installing in any agent that handles wallet, treasury, signing, approvals, or fund movement. It appears safe as a local advisory router, but do not treat its output as an authorization or safety gate until high-stakes checks take precedence over zero-LLM routing and wallet-sensitive terms cannot be downgraded by deterministic keywords.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/route_message.py:59
Finding

Security-sensitive wallet requests can bypass high-stakes review

Content
View full analysis

Vulnerability Details

File Location: scripts/route_message.py:59-61, 70-87, 157-159
Vulnerability Type: Unsafe routing precedence and incomplete high-stakes detection
Risk Level: Medium

Vulnerable Code

python
def detect_task_type(text: str, explicit: str | None) -> str:
    if explicit and explicit != "auto":
        return explicit
    if matches_any(text, ZERO_LLM_PATTERNS):
        return "deterministic"
    if matches_any(text, WALLET_PATTERNS):
        return "wallet"
    if matches_any(text, VISION_PATTERNS):
        return "vision"
    if matches_any(text, LONG_CONTEXT_PATTERNS):
        return "long-context"
    if matches_any(text, CODE_PATTERNS):
        return "code"
    return "chat"
python
def route_message(text: str, task_type: str, high_stakes: bool, allow_zero_llm: bool) -> RouteDecision:
    if task_type == "deterministic" and allow_zero_llm:
        return RouteDecision(
            route="zero-llm",
            fallback=None,
            risk="low",
            task_type=task_type,
            reason="Matched a deterministic workflow that should bypass LLM usage.",
        )

    if high_stakes:
        return RouteDecision(
            route="bankr/claude-opus-4.6",
            fallback="bankr/claude-sonnet-4.5",
            risk="high",
            task_type=task_type,
            reason="Explicit high-stakes escalation; prioritize caution over cost.",
        )
python
parser.add_argument("--high-stakes", action="store_true", help="Force the high-stakes route")
parser.add_argument("--allow-zero-llm", choices=["true", "false"], default="true", help="Allow deterministic zero-LLM routing")
parser.add_argument("--json", action="store_true", help="Emit JSON")
args = parser.parse_args()

text = args.text.strip().lower()
task_type = detect_task_type(text, args.task_type)
decision = route_message(text, task_type, ar
...[truncated 3160 chars]
Remediation
View remediation

Remediation Suggestions

  1. Evaluate security-sensitive wallet indicators before deterministic indicators. Signing, approvals, credential handling, contract permissions, and ambiguous fund movements should automatically receive high-stakes classification.
  2. Move the high-stakes branch ahead of the deterministic branch so that a high-stakes decision cannot be overridden by zero-LLM routing.
  3. Replace broad deterministic keywords such as script and cron with an allowlist of known, named, and validated deterministic operations.
  4. Do not unconditionally trust --task-type deterministic. Treat explicit task types as hints, or reject deterministic routing when sensitive wallet terms are present.
  5. Require deterministic handlers to be registered and associated with defined input validation, permitted actions, and risk levels before returning zero-llm.
  6. Add collision tests for messages containing both deterministic and wallet terms, including signing, token approvals, treasury transfers, and script-driven transactions.
  7. Ensure downstream consumers treat the result as a recommendation rather than transaction authorization and independently enforce wallet approval and signing controls.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The routing rules use vague categories like 'casual conversation' and 'low-stakes' without objective criteria, which can cause inconsistent or unsafe model selection. In a model-router skill, ambiguity can misclassify sensitive requests onto cheaper or weaker routes, reducing scrutiny for actions that may affect funds, security, or operational decisions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Phrases like 'important but not unusually risky' and 'better judgment' are subjective and leave too much discretion to the router or calling agent. Because this skill governs per-message model selection, that ambiguity can route treasury or wallet-related operations to a model that is not appropriate for safety-critical reasoning, increasing the chance of bad recommendations or insufficient review.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The high-stakes escalation policy relies on broad triggers such as whether a request is 'explicitly marked high-stakes' or whether failure would be 'expensive enough,' which can fail open when users do not label risk clearly. In a workflow involving wallet security, approvals, and fund movement, unclear escalation thresholds can cause truly dangerous requests to bypass the most cautious model path.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

This code explicitly detects wallet and treasury operations and routes them to a model for handling, but there is no confirmation prompt, warning message, or explanatory comment/docstring disclosing that financially sensitive requests will be processed this way. For a code file, safety-relevant handling of wallet actions should include some visible disclosure unless the warning is documented elsewhere, which is not evident in this file.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.