ClawHub
Back to skill

Security audit

Message Test Designer

Security checks for vulnerabilities and agentic risk

Overview

This skill is a scoped marketing message-test design helper with disclosed, user-confirmed memory writes and no bundled executable code.

Before installing, be aware that the skill may read existing narrative and claims memory and, with your confirmation, save test specs or propose claim/narrative updates. Its limited significance-check guidance should be treated as a convenience, while full result analysis should remain with the named analyzer skill.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

L18-L20 explicitly states the skill never runs the panel, analyzes results, or adjudicates a claim. Later, L54 and L66 say the skill may compute significance on returned experiment counts, which is a form of result analysis. This is an active contradiction within the file's own documented intent.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The manifest repeatedly limits scope to producing a test design spec and says the skill does not analyze results. However, L54 describes using experiment.py on returned per-variant counts to determine whether a preference gap is real, and L66 explicitly says the skill may compute significance from returned counts. That crosses from design into post-experiment analysis.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

md
## Save Results

After delivering the spec, ask: "Save these results for future sessions?" On confirmation, write `memory/narrative/message-test-designer/YYYY-MM-DD-<topic>.md` per the [skill-contract.md](../../../references/skill-contract.md) §Save Results Template. Any unverifiable claim found in a stimulus goes only to `memory/events/claims.ndjson` via an authorized `operation: propose` request to `registry-events.py`; canon-grade facts (a durable positioning or lexicon change) are proposed only to `memory/events/narrative.ndjson` via an authorized `operation: propose` request to `registry-events.py` — [narrative-registry](../../../protocol/narrative-registry/SKILL.md) is the sole writer of `memory/narrative-registry/` canonical files. Do not write memory without asking.

## Reference Materials

Static analysis

No suspicious patterns detected.