ClawHub
Back to skill

Security audit

Cross-platform App Checklist

Security checks for vulnerabilities and agentic risk

Overview

This skill provides a scoped app-review checklist with clear authorization boundaries and no hidden execution or data access.

Choose the app, platforms and review scope. Keep secrets out of evidence reports, and separately authorize state-changing tests, privileged diagnostics, builds, signing and publishing. The scanner alerts examined here are unsupported by their surrounding artifact text; the supplied static scan reports no findings.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Rogue AgentSelf-Modification, Session Persistence
Findings (41)

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · references/checklist.md (reported line 190)May include surrounding context.

md
- **M2 Audio routes.** Speaker / earpiece / wired / Bluetooth routes, and
  devices connecting or disconnecting mid-use.
- **M3 Camera.** Front / back switch, mirroring, rotation, release after use
  (verify this app stops capture in OS privacy UI), a clear state when the OS
  takes the camera away (multitasking, background, another app).
- **M4 Formats crossing platforms.** Media and files produced on one
  platform open on the others (HEIC / HEVC to Windows / Linux, path

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/desktop.md (reported line 269)May include surrounding context.

md
permissions; test updates while running, interrupted downloads, native
  helper replacement and migration from previous data formats. Keep user
  data outside the replaceable application bundle. Do not assume every
  AppImage supports AppImageUpdate or every installation allows self-update.

**Verify.** Clean install, first launch, denied privileges, file / URL
activation while closed and running, previous-version update, interrupted

Instruction Override

High
Category
Prompt Injection
Confidence
70% confidence
Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · references/input.md (reported line 423)May include surrounding context.

md
`adb shell pm verify-app-links --re-verify <package>`, wait a few minutes,
then check that `adb shell pm get-app-links <package>` shows `verified`
for each host. Apple: on a Mac run `sudo swcutil dl -d <host>` and
`sudo swcutil verify -d <host> -j <aasa-json> -u <URL>`; on iOS enable
Developer Mode and use the Universal Links diagnostics under Settings >
Developer. Windows: run
`AppHostRegistrationVerifier.exe <host> <package family name> <file>`.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/permissions.md (reported line 269)May include surrounding context.

md
**Rule.** Choose secret accessibility, migration and backup behavior together;
encryption without a recoverable key / reauthentication path can lose data.

- Apple: store secrets in Keychain and deliberately choose accessibility,
  access groups, synchronizability and `ThisDeviceOnly` behavior. Handle
  locked-device / biometric-policy failures without replacing valid data
  with empty defaults. File protection is covered in [lifecycle.md, B2](lifecycle.md#b2-persist-before-suspension--p0).

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/permissions.md (reported line 286)May include surrounding context.

md
- Keychain items can remain after iOS app deletion, but uninstall persistence
  is not a documented lifetime guarantee. Implement explicit logout / account
  reset and server token revocation. A missing `UserDefaults` first-launch
  flag alone is not a safe reason to clear an entire Keychain access group:
  restoration and other apps / extensions can share state. Scope any cleanup
  to items the app owns and to an explicit account / installation policy.
- Android Auto Backup is normally enabled for participating apps; decide

Context Window Stuffing

Medium
Category
Memory Poisoning
Confidence
85% confidence
Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · references/checklist.md (reported line 10)May include surrounding context.

md
- **L1 Size range.** Usable at the smallest supported phone / window size
  through a maximised desktop window, including phone landscape, tablet
  panes, resizable iPad windows and foldables. Include narrow stress cases
  such as 320 pt / dp; that is a test width, not a universal OS minimum.
- **L2 Breakpoints by available width.** Layout decisions read the window's
  available size, never the OS or a "device type" guess; every component

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/display.md (reported line 201)May include surrounding context.

md
**Verify.** Inspect installed release icons in the launcher, app switcher,
Dock / taskbar, tray / menu bar and a real notification. Check small sizes,
several masks and light / dark / themed appearances. Cold-launch a fresh
install in both themes and inspect the final plist / packaged assets.

## D6 Theme and contrast — P1

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/flutter.md (reported line 179)May include surrounding context.

md
checked state agrees. See [PlatformMenuBar](https://api.flutter.dev/flutter/widgets/PlatformMenuBar-class.html).
- Verified links (I8): since Flutter 3.27 the embedder's deep-link handler
  defaults to **on** (`flutter_deeplinking_enabled` meta-data on Android,
  `FlutterDeepLinkingEnabled` in Info.plist). With Flutter's handler, links
  go to the router (`go_router` / `Router` / `MaterialApp.routes`); with
  a plugin such as `app_links`, set both flags to `false` or links are
  handled twice / not at all. Instantiate the plugin early enough to catch

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/flutter.md (reported line 291)May include surrounding context.

md
integrations enable the required `PERMISSION_*` macros in the Podfile
  (for example `PERMISSION_CAMERA=1`). Current Swift Package Manager
  integrations derive enabled permissions from usage-description keys in
  the app's Info.plist; they do not use the Podfile setup. Follow the
  **locked version's** instructions and validate flavor / build-specific
  plists and SPM caching behaviour. See
  [permission_handler setup](https://pub.dev/packages/permission_handler).

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/flutter.md (reported line 293)May include surrounding context.

md
integrations derive enabled permissions from usage-description keys in
  the app's Info.plist; they do not use the Podfile setup. Follow the
  **locked version's** instructions and validate flavor / build-specific
  plists and SPM caching behaviour. See
  [permission_handler setup](https://pub.dev/packages/permission_handler).
- Use the returned request result and re-check on return from Settings;
  handle limited / restricted / permanently denied states according to

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/flutter.md (reported line 301)May include surrounding context.

md
access. macOS / Linux support must come from an actual implementation,
  not an assumed `permission_handler` method.
- Inspect the merged Android **release / flavor** manifest and packaged
  Info.plist / privacy manifests / entitlements, including plugin-added
  declarations. Intermediate paths vary by Gradle / plugin version; use
  the build's manifest-merger report or APK Analyzer instead of hard-coding
  one directory. See [permissions.md](permissions.md).

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/flutter.md (reported line 392)May include surrounding context.

md
[UI performance](https://docs.flutter.dev/perf/ui-performance) and
  [Impeller](https://docs.flutter.dev/perf/impeller).
- 120 Hz on iPhone needs `CADisableMinimumFrameDurationOnPhone = true` in
  Info.plist. Current `flutter create` templates include it; older or
  hand-edited runners may not. Drive custom animation from elapsed time
  (`Ticker` / `AnimationController`), not frame counts.
- Size / startup (F2): `flutter build <target> --analyze-size` (apk,

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/layout.md (reported line 268)May include surrounding context.

md
**Verify.** Check all four interface orientations on iPad, phone landscape
when supported, and Android tablets / foldables on target-appropriate OS
versions. Test 599 / 600 / 601 dp display configurations, freeform resizing,
rotation lock, and declarations in the merged release manifest / plist.

## L7 Overlays — P1

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/performance.md (reported line 23)May include surrounding context.

md
on the model, and Apple's own pages disagree on it for iPad Pro. Low
  Power Mode and thermal limits can remove faster rates, so an app cannot
  presume a rate at any time; use actual display-link timing.
- On iPhone, Core Animation does not exceed 60 Hz unless Info.plist sets
  `CADisableMinimumFrameDurationOnPhone` to `true`; iPad Pro needs no key.
- With `CADisplayLink`, set `preferredFrameRateRange` per content and drive
  updates from `targetTimestamp`; a callback that overruns it loses the

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/permissions.md (reported line 13)May include surrounding context.

md
Android names below omit the `android.permission.` prefix. Consent and
availability checks still apply when no declaration is needed.

| Capability | Android (manifest / API path) | iOS / iPadOS (Info.plist unless noted) |
|---|---|---|
| Internet | `INTERNET`; `ACCESS_NETWORK_STATE` only when inspecting connectivity | No generic Internet permission; transport-security rules still apply |
| LAN / discovery | `INTERNET`; Wi-Fi / LAN rules below | `NSLocalNetworkUsageDescription`; `NSBonjourServices` for applicable Bonjour browsing / registration; multicast entitlement when required |

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/permissions.md (reported line 52)May include surrounding context.

md
privacy switches are separate gates. Missing an Apple usage string can
  terminate the app for protected APIs; other failures may deny access.
  A plugin does not supply the host app's user-facing explanation by itself.
- Localize usage descriptions through the platform's Info.plist localization
  resources, such as `InfoPlist.strings`; explain the specific feature.
- macOS hardened-runtime resource entitlements are needed even outside the
  App Sandbox. `com.apple.security.device.audio-input` is documented for

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/permissions.md (reported line 96)May include surrounding context.

md
Keep legacy Bluetooth permissions version-bounded for older devices.

**Verify.** Inventory feature API paths and inspect the merged Android
manifest, packaged `Info.plist` / localized strings, signed entitlements,
Windows package / trust level and Linux sandbox permissions. Run the signed
release package on a fresh permission state, including optional-hardware
devices. CI declaration checks support this; they do not prove runtime consent.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/flutter.md (reported line 32)May include surrounding context.

md
Give sheet content appropriate bottom safe-area / keyboard padding and
  scrolling, using the route's constraints. `isScrollControlled` alone
  neither scrolls arbitrary content nor keeps a text field visible. See
  [bottom-sheet semantics](https://api.flutter.dev/flutter/material/showModalBottomSheet.html).
- Android 15 / target API 35 enables edge-to-edge by default; target API 36
  on Android 16+ removes the old opt-out. Prefer migrating insets over
  relying on `SystemChrome.setEnabledSystemUIMode` / colour calls to undo

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/flutter.md (reported line 50)May include surrounding context.

md
with the display's pixel ratio. Do not use the display size for pane
  breakpoints. iPad multitasking can ignore orientation requests too;
  full-screen opt-outs are not a durable adaptation strategy. See
  [orientation API limits](https://api.flutter.dev/flutter/services/SystemChrome/setPreferredOrientations.html)
  and [orientation rules](layout.md).
- Use scrollable / collapsing headers on short windows.
  `AlertDialog(scrollable: true)` scrolls title and content; its actions use

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/flutter.md (reported line 82)May include surrounding context.

md
single multiplier. If a specific decorative element must clamp, use the
  scaler instance's `clamp` or `MediaQuery.withClampedTextScaling` locally
  and justify the limit; do not disable accessibility scaling app-wide.
  See [TextScaler](https://api.flutter.dev/flutter/painting/TextScaler-class.html).
- Avoid `FittedBox(fit: BoxFit.scaleDown)` around essential text that should
  wrap. Chips, segmented controls and action rows need tests with long
  labels and large text. `DropdownButton(isExpanded: true, isDense: false)`

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/flutter.md (reported line 115)May include surrounding context.

md
no `cacheWidth` parameter. `MediaQuery.devicePixelRatioOf(context)` can
  change at runtime; update derived decode / screenshot sizes without
  rescaling the logical UI twice. Bound caches and repeated decode work.
  See [Image.asset](https://api.flutter.dev/flutter/widgets/Image/Image.asset.html)
  and [M5](media-devices.md).
- `flutter_launcher_icons` supports platform-specific sources and Android
  `adaptive_icon_monochrome`; do not claim that it cannot generate a

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/flutter.md (reported line 150)May include surrounding context.

md
independently interactive scrollbars. Avoid duplicate automatic / manual
  bars. Mouse drag-to-scroll is not the same as wheel / trackpad scrolling;
  configure `ScrollBehavior.dragDevices` deliberately. See
  [Scrollbar](https://api.flutter.dev/flutter/material/Scrollbar-class.html).
- For a custom Enter-to-send handler, active IME composition requires a
  **valid, non-collapsed** composing range. `isValid` alone also accepts an
  empty range and can suppress sending forever. Prefer `TextField` editing

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/flutter.md (reported line 161)May include surrounding context.

md
it already happened; do not pop again when `didPop` is true. Check the
  merged `android:enableOnBackInvokedCallback` configuration and SDK / router
  support instead of assuming adding a manifest flag completes migration.
  See [PopScope](https://api.flutter.dev/flutter/widgets/PopScope-class.html).
- `IconButton.tooltip` normally supplies its accessible description; avoid
  duplicate wrapper labels. For custom controls expose the correct name,
  role, state and action with `Semantics`. Use `tester.ensureSemantics()`,

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/flutter.md (reported line 176)May include surrounding context.

md
integration needs native `UIMenuBuilder` work or a verified plugin, and
  Windows / Linux need in-window menus (`MenuBar`, `MenuAnchor`). Keep one
  command model behind menus, `Shortcuts` and toolbar buttons so enabled /
  checked state agrees. See [PlatformMenuBar](https://api.flutter.dev/flutter/widgets/PlatformMenuBar-class.html).
- Verified links (I8): since Flutter 3.27 the embedder's deep-link handler
  defaults to **on** (`flutter_deeplinking_enabled` meta-data on Android,
  `FlutterDeepLinkingEnabled` in Info.plist). With Flutter's handler, links

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/flutter.md (reported line 221)May include surrounding context.

md
a mobile lifecycle state, not a desktop focus-loss event. Callbacks can
  be skipped during abrupt termination. Persist important edits as they
  happen; do not wait exclusively for `detached` or `onExitRequested`.
  See [AppLifecycleState](https://api.flutter.dev/flutter/dart-ui/AppLifecycleState.html).
- Apply resource-specific policy: a focus change alone should not end a
  call, but camera plugins / OS capture interruptions may require releasing
  and reacquiring capture even on `inactive`. Likewise valid background

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
references/permissions.md:19