ClawHub
Back to skill

Security audit

Did my message actually go out? Delivery verified on the wire

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent delivery-confirmation helper, but users should understand that it depends on enabling a local ledger plugin to observe send outcomes.

Before installing, confirm you are comfortable enabling the separate clawphylax plugin, which the skill says keeps a local ledger of requests and tool outcomes so delivery claims can be checked. Review that plugin independently if request metadata, send history, or tool outcomes are sensitive in your environment.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Behavior Manipulation

Medium
Category
Prompt Injection
Confidence
75% confidence
Finding

Subtle instructions detected that may alter agent decision-making or introduce hidden biases.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md
## Output

First line `ACTION: REPORT_AS_SENT` / `ACTION: DO_NOT_REPORT_AS_SENT` / `ACTION: VERIFY_ON_RECEIVING_SIDE` / `ACTION: SEND_FIRST`, then EVIDENCE (runtime result; channel API request and status), DO NOT, NEXT, SCOPE. Never tell the user a message was sent on CLAIMED_ONLY, PENDING, NOT_DELIVERED or CANCELLED.

## For agents

Static analysis

No suspicious patterns detected.