ClawHub
Back to skill

Security audit

create-agent-harness

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed agent-harness generator, but it installs broad persistent agent behavior that can retain prompt summaries, remove legacy harness files, and open pull requests with limited final confirmation.

Install only in repositories where you intentionally want a skill to reshape the agent harness. Before continuing past the discovery gate, review the migration plan, deletion list, generated .claude/settings.json, hooks, sub-agents, and memory policy. Disable or change the prompt-summary memory rule for confidential work, keep sensitive memory out of commits if needed, and require explicit confirmation before git rm, push, or PR creation.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (29)

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · SKILL.md (reported line 637)May include surrounding context.

  • settings.local.json holds local overrides and is not versioned — add it to .gitignore.
bash
python3 -c "import json; json.load(open('.claude/settings.json')); print('settings.json OK')"

Tools and MCP. Classify by risk when defining permissions and documenting tools.

MCP Config Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Content

Scanner excerpt · references/platform-quirks.md (reported line 22)May include surrounding context.

md
| Client / platform | MCP key | Notes |
|---|---|---|
| Claude Code | `.mcp.json` or `mcpServers` in `.claude/settings.json` | Uses `mcpServers` array |
| Devin Desktop | `.devin/mcp.json` | Uses `serverUrl` (not `url`) for remote servers |
| OpenCode | `.opencode/config.json` | MCP under `mcp` key, not `mcpServers` |
| Cursor | `.cursor/mcp.json` | MCP under `mcpServers` key |
| Gemini CLI | `.gemini/config/mcp_config.json` | Follow Google's MCP schema |

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The file explicitly says the skill should be used when the user asks or mentions it in English or Portuguese. This imposes a locale/language condition in natural language without opt-in, and no region-specific justification is provided elsewhere in the file.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 266)May include surrounding context.

2.1 Prepare the destination

bash
mkdir -p .claude/agents .claude/skills .claude/commands \
         .claude/hooks .claude/memory .claude/knowledge .claude/rules \
         .specs

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill requires persistent logging of summaries of every user prompt/instruction into repository files, which exceeds what is necessary to initialize or migrate an agent harness. This creates a durable record of potentially sensitive user requests, internal plans, or confidential context inside the repo, increasing the risk of unintended disclosure through commits, PRs, branch sharing, or later retrieval by other agents.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

Mandating always-on persistent logging of every user prompt and session details into long-term memory creates systematic data retention inside the repository. In the context of a harness-generation skill, this is more dangerous because the generated structure is intended to persist across sessions and may be committed, shared, or consumed by future agents, amplifying privacy and confidentiality risks.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Requiring migration logic to preserve an 'always-save' rule for prompts, history, and knowledge propagates risky retention behavior into existing repositories. This turns a one-time harness migration into a durable policy change that can institutionalize over-collection of user-derived data and increase the chance that sensitive content is retained indefinitely.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The memory protocol explicitly directs the agent to append a summary of every user prompt or instruction to permanent long-term memory. This is dangerous because summaries can still contain sensitive business intent, security issues, customer references, or proprietary requests, and permanent append-only storage makes later deletion or correction difficult.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The guidance to 'always save' summaries of every user prompt and discovered knowledge reinforces broad, mandatory retention across the generated harness. In this context, the skill is not merely using memory internally; it is installing a persistent behavior pattern into repositories, which can expose sensitive operational context to collaborators and downstream automation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest description says to use the skill proactively to create or update architecture documentation, which is an overly broad activation trigger. In an agentic environment, this can cause the skill to run without clear user intent, increasing the chance of unauthorized file creation or modification under docs/architecture/ and unnecessary tool execution.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The instruction to relay the gap-analysis execution gate in pt-BR forces a specific language output without user opt-in. This can reduce user comprehension, obscure important approval-gate details, and increase the likelihood of mistaken approval or misunderstanding in security- or governance-sensitive workflows.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill is described for proactive use as the primary tech lead, but its trigger condition is broad enough that it could activate for many engineering-related requests without clear boundaries. In an agentic system with Bash, file editing, and delegation capabilities, overbroad activation increases the chance of unnecessary orchestration, scope creep, or unintended execution on tasks that should have required narrower routing or explicit user confirmation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The instruction to invoke the orchestrator for 'any feature, change or delivery request' is effectively unbounded and encourages automatic delegation without evaluating whether the request is safe, minimal, or within intended scope. Because this agent can trigger a larger execution pipeline and relay approvals, the lack of scope limits may lead to excessive privilege use, unintended destructive workflows, or execution on underspecified requests.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The activation text is broad enough to match many ordinary planning requests, which can cause the skill to be invoked outside its intended scope. In an agent harness, overly permissive activation increases the chance of unnecessary tool use and unintended repository modifications through downstream planning workflows.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The description says to use the skill "PROACTIVELY" for code reviews and related analysis, but it does not define clear trigger boundaries or exclusion conditions. Because this is manifest-style metadata in a markdown file, the activation condition is ambiguous and may overlap with many ordinary coding situations rather than a narrowly scoped invocation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manifest description says to use the skill "PROACTIVELY" to generate, execute, and validate tests, but it does not define narrow trigger conditions or approval boundaries. In an agentic environment, this can cause the skill to activate broadly and run commands, edit files, or recurse into test-generation flows when not explicitly requested, increasing the chance of unintended actions and scope expansion.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The protocol explicitly requires persistent logging of every user prompt, history, and discovered knowledge into repository files that are intended to be committed and shared. Even with later guidance forbidding secrets and PII, this creates a systematic retention channel for sensitive business context, proprietary instructions, and accidentally supplied confidential data without any user-facing consent or minimization mechanism.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

Mandating retention of prompts, history, and knowledge creates a durable natural-language record that can capture secrets, internal plans, credentials mentioned by mistake, or sensitive repository context. Because the protocol says both memory tiers are committed and shared, any accidental capture can propagate to other collaborators and repository history, increasing blast radius and making cleanup difficult.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

Requiring that every user prompt or instruction be appended to long-term memory guarantees systematic collection of user inputs regardless of sensitivity or relevance. In the context of an agent harness, users commonly provide repo details, incident data, operational instructions, or confidential code context, so this requirement materially raises data retention and disclosure risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The document includes git rm commands that delete legacy files and directories, but it does not pair them with a strong warning about irreversible repository changes or recommend preview/confirmation steps. In the context of an agent-migration skill, an automated agent may execute these commands mechanically after an imperfect migration, causing loss of configuration, instructions, or historical artifacts that were not fully preserved.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The template instructs the agent to immediately open a PR once the Definition of Done is complete, without a separate explicit user confirmation step. In an agent harness, this removes a meaningful human approval gate before making an external repository action, which can lead to unintended code publication, workflow triggering, or policy violations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The agent loop codifies automatic PR opening as part of the workflow after DoD completion, which authorizes a repository-side action without opt-in at the moment of execution. In practice, this can cause the agent to push changes into organizational review systems, trigger CI/CD, or expose incomplete or sensitive work when the user expected only local preparation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This instruction tells the parent agent to open a PR immediately after completion with no confirmation step, reinforcing autonomous external action. In the context of an agent bootstrap/migration skill, that is more dangerous because the skill is designed to shape default agent behavior across repositories, potentially normalizing unsolicited PR creation at scale.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/validation-artifacts.md (reported line 21)May include surrounding context.

md
| Knowledge entry with no cited source | Add the source path — ungrounded knowledge causes hallucination |
| Decisions taken with no auditable trail | Append to `## Decisions` with rationale and discarded alternatives |
| Everything loaded always-on | Reclassify as on-demand and reference it from `CLAUDE.md` |
| No verification loop | Mandatory lint, test, CI |
| Stateless sessions | `memory.md` plus dated long-term files |
| Memory as an unbounded log | Promote durable entries and reset `memory.md` |
| Two files holding the same state | One concept, one location |