Security audit

clawlist

Security checks for vulnerabilities and agentic risk

Overview

The skill is a task-management workflow, but it claims very broad activation and defines persistent heartbeat-driven tasks without clear limits or user controls.

Install only if you intentionally want a broad project-management workflow that can create persistent ongoing tasks. Before using it for monitoring or recurring external actions, require explicit approval, clear allowed operations, an expiration date, and a documented way to pause or delete each task.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:3
Finding: Overbroad Mandatory Workflow Can Hijack Agent Task Execution
Content: View full analysis
Remediation: View remediation

T06 · System Persistence

Warning

Location: SKILL.md:43
Finding: Cross-Session Heartbeat Execution of Persistent Tasks Lacks Safety Controls
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest description mandates use for 'any multi-step project, long-running task, or infinite monitoring workflow,' which is broad enough to capture a large fraction of normal agent activity. Overbroad routing criteria can force this skill into contexts where it is unnecessary, causing inappropriate delegation, task-file writes, or persistent workflow activation across unrelated tasks.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The 'ALWAYS use clawlist' section further expands scope without boundaries, listing common situations like 'starting any new project' and 'breaking down complex goals' that are subjective and likely to match routine work. In an agent ecosystem, this can create skill overreach, unnecessary persistence via ongoing task tracking, and interference with safer or more specialized skills.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.