ClawHub
Back to skill

Security audit

Contract Helper

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent influencer-contract helper, but it asks to persist sensitive contract information in shared memory despite a read-only style capability manifest and no explicit user consent step.

Review this skill before installing if you handle confidential contracts. It appears useful and not malicious, but it should only be used where you are comfortable with drafted agreements, review memos, and signed deal terms being written into persistent/shared memory unless the host blocks those writes or asks for consent first.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:33
Finding

Persistent Storage of Sensitive Contract Data Exceeds Declared Capabilities

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:33-35, 67; related capability declaration in distribution-manifest.json:2-6
Vulnerability Type: Undeclared persistent state mutation and excessive retention of sensitive data
Risk Level: Medium

Vulnerable Code

SKILL.md:33-35:

markdown
- **Reads**: campaign brief, agreed deliverables, compensation figure, platform list, usage-rights and exclusivity needs, any pasted incoming agreement. If `memory-management` is active, prior outreach terms and budget caps load from the hot cache. For rostered creators, read `memory/creators/<handle-slug>.md` — the [creator-registry](../../../protocol/creator-registry/SKILL.md) roster record — for existing exclusivity windows, contract status, usage-rights history, and standard-range anchors before drafting or reviewing.
- **Writes**: drafted agreement or review memo to `memory/influencer/contract-helper/YYYY-MM-DD-<topic>.md`. Signed terms (usage-rights window, exclusivity scope, final rate) also go as a one-line update to `memory/events/creators.ndjson` via an authorized `operation: propose` request to `registry-events.py` — only `creator-registry` writes canonical roster records.
- **Promotes**: durable facts (signed terms, usage-rights window, exclusivity scope, payment schedule) to `memory/hot-cache.md`.

SKILL.md:67:

markdown
Save the drafted agreement or review memo to `memory/influencer/contract-helper/YYYY-MM-DD-<topic>.md`, and promote durable signed terms to the hot cache. Once terms are signed, also submit them (usage-rights window, exclusivity scope, final rate) as a one-line update to `memory/events/creators.ndjson` via an authorized `operation: propose` request to `registry-events.py` for [creator-registry](../../../protocol/creator-registry/SKILL.md) to reconcile into the roster record.

The package manifest declares only the following capabilities in `distribution-manifest.json ...[truncated 3264 chars]

Remediation
View remediation

Remediation Suggestions

  1. Update the distribution manifest to declare every required persistent state-write capability accurately. Installation should fail closed when the host cannot grant those capabilities.
  2. Default to inline delivery and make persistence optional. Obtain explicit, informed user consent before saving an agreement or promoting any term into shared memory.
  3. Apply data minimization:
    • Do not place physical addresses, email addresses, signatures, payment instructions, or complete contract text in the hot cache.
    • Store only the minimum operational fields needed for an explicitly approved workflow.
    • Prefer references or opaque record identifiers over duplicated contract content.
  4. Separate confidential contract storage from broadly shared agent memory and enforce per-user, per-workspace, and per-skill access controls.
  5. Encrypt sensitive state at rest and ensure logs and event streams do not contain unnecessary personal or financial information.
  6. Define retention periods and provide deletion and correction mechanisms that remove all duplicated copies, including archive, cache, event-stream, and registry records.
  7. Validate authorization at runtime before each write. Text stating that an operation is “authorized” must not substitute for a host-enforced permission check.
  8. Document exactly which fields are written, where they are stored, which components can read them, and how long they remain available.
  9. Add automated conformance checks ensuring that instructions cannot request filesystem or canonical-state mutations outside the manifest's declared capability ceiling.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

L11 says to use the skill when 'reviewing an incoming contract or agency paper, negotiating terms such as usage rights or exclusivity, explaining standard clauses, or building a reusable partnership template,' which describes very broad legal-document tasks without consistently constraining them to influencer or creator agreements. Although other lines mention influencer context, this invocation text is ambiguous enough to overlap with many ordinary contract-help requests and may cause unintended activation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs the agent to persist drafted agreements, review memos, and signed deal terms to memory files and event logs, but it does not clearly notify the user or require consent before storing potentially sensitive contract contents. Because contracts can contain confidential business terms, personal data, and legal obligations, silent persistence increases the risk of unauthorized retention, overexposure to other skills, and downstream privacy or compliance issues.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/templates.md (reported line 171)May include surrounding context.

md
### 3.5 Content Modifications

Brand [MAY/MAY NOT] modify Content. Any modifications require [written approval from Influencer / no approval].

---

Unbounded Resource Access

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · references/templates.md (reported line 473)May include surrounding context.

|--------|----------|--------------| | Usage rights | 12-24 months | Perpetual requested | | Exclusivity | 30-90 days | 6+ months requested | | Revisions | 2 rounds | Unlimited requested | | Payment | Net 30 | Net 60+ requested | | Whitelisting | Separate fee | Included free |

text

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · references/templates.md (reported line 187)May include surrounding context.

md
### 4.2 Competing Brands

For purposes of this Agreement, competing brands include but are not limited to:
- [Competitor 1]
- [Competitor 2]
- [Competitor 3]

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · references/templates.md (reported line 231)May include surrounding context.

md
### 4.2 Competing Brands

For purposes of this Agreement, competing brands include but are not limited to:
- [Competitor 1]
- [Competitor 2]
- [Competitor 3]

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · references/templates.md (reported line 276)May include surrounding context.

md
### 4.2 Competing Brands

For purposes of this Agreement, competing brands include but are not limited to:
- [Competitor 1]
- [Competitor 2]
- [Competitor 3]

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · references/templates.md (reported line 336)May include surrounding context.

md
### 4.2 Competing Brands

For purposes of this Agreement, competing brands include but are not limited to:
- [Competitor 1]
- [Competitor 2]
- [Competitor 3]

Static analysis

No suspicious patterns detected.