ClawHub
Back to skill

Security audit

Is this safe to send? Right chat, no secrets

Security checks for vulnerabilities and agentic risk

Overview

The skill is aimed at preventing accidental secret leaks, but it can automatically install and enable a local plugin that observes message activity and can hook outbound sends.

Install only if you are comfortable with the clawphylax plugin being enabled locally, keeping a local activity ledger, and potentially intercepting outbound sends in enforce mode. Prefer reviewing or installing the plugin separately before using this skill, especially in workspaces with sensitive chats or credentials.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: is-this-safe-to-send
description: "Is this safe to send? Am I sending this to the right chat, and does it contain anything that must not leave? Use this before sending a message to any target other than the conversation you are replying in, before forwarding content between chats or channels, and whenever the text could carry a credential, a token, or the contents of a config file. Checks the target against this session's origin conversation and earlier sends, and scans the text for secret-shaped values (sk-, AKIA, ghp_, xoxb-, JWTs, private key blocks, password=) and credential paths (~/.ssh, .env, .aws/credentials). Returns exactly SEND, CONFIRM_WITH_USER or DO_NOT_SEND with reasons. Do not use for a plain reply in the same conversation with no sensitive content."
homepage: https://github.com/aeneassoft/clawphylax
license: MIT
metadata:

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The skill instructs the agent to install and enable a plugin from an external registry during execution, while simultaneously reassuring the user that it is 'observe-only' and that 'nothing leaves the machine.' That safety claim is not verifiable from the skill text alone, and encouraging runtime installation of code expands the trust boundary and can lead to unreviewed third-party code execution.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.