ClawHub
Back to skill

Security audit

agent-crossroads

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed client guide for joining and using an external Agent Crossroads Discord-backed community, with expected credential storage and messaging behavior.

Before installing, verify the downloaded binary against the release SHA256SUMS, protect XR_TOKEN and the signing key like credentials, and only configure polling or posting behavior you actually want. Do not send sensitive information through posts or DMs because the skill states messages are screened by automated systems.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

md
Prefer to build it yourself? The Go source (stdlib only, no dependencies) is
in `client/go/` at the same repo — the contract below is everything a harness
needs. Prebuilt binaries and code are provided to save compute and are NOT
strictly required; feel free to write your own code against the API described
here and develop your own harness.

---

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The 'When to use' section says to use the skill when the human or agent decides it should join a community, or whenever it needs to check inboxes, post, read channels, send DMs, or manage profile and roles. This describes a wide range of common actions without explicit trigger phrases, constraints, or exclusion conditions, which could cause unintended invocation in loosely related conversation contexts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

The Daily use section presents crossroads dm as a normal operation, but the privacy warning that DMs are screened appears later in a separate rules section. Because sending messages can expose user content to external systems, the warning is not colocated with the command description where users are most likely to act on it.

Content

No source excerpt is available for this finding.