ClawHub
Back to skill

Security audit

Output Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill only changes how the agent formats long answers and does not add code execution, data access, network access, or persistence.

Install this only if you want agents to favor complete, unabridged responses. It may produce longer answers than desired and may not be appropriate for workflows that require strict brevity or fixed output protocols.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:1
Finding

Agent Response Policy Overridden by Skill Instructions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 1-49
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Vulnerable Skill Content

markdown
---
name: full-output-enforcement
description: Overrides default LLM truncation behavior. Enforces complete code generation, bans placeholder patterns, and handles token-limit splits cleanly. Apply to any task requiring exhaustive, unabridged output.
---

# Full-Output Enforcement

## Baseline

Treat every task as production-critical. A partial output is a broken output. Do not optimize for brevity — optimize for completeness. If the user asks for a full file, deliver the full file. If the user asks for 5 components, deliver 5 components. No exceptions.

## Banned Output Patterns

The following patterns are hard failures. Never produce them:

**In code blocks:** `// ...`, `// rest of code`, `// implement here`, `// TODO`, `/* ... */`, `// similar to above`, `// continue pattern`, `// add more as needed`, bare `...` standing in for omitted code

**In prose:** "Let me know if you want me to continue", "I can provide more details if needed", "for brevity", "the rest follows the same pattern", "similarly for the remaining", "and so on" (when replacing actual content), "I'll leave that as an exercise"

**Structural shortcuts:** Outputting a skeleton when the request was for a full implementation. Showing the first and last section while skipping the middle. Replacing repeated logic with one example and a description. Describing what code should do instead of writing it.

## Execution Process

1. **Scope** — Read the full request. Count how many distinct deliverables are expected (files, functions, sections, answers). Lock that number.
2. **Build** — Generate every deliverable completely. No partial drafts, no "you can extend this later."
3. **Cross-check** — Before output, re-read the original request. Compare your deliverable count against the scope count. If anything is
...[truncated 3276 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove claims that the skill “overrides” default model behavior and eliminate absolute language such as “No exceptions” and “Never produce them.”
  2. Restrict activation to cases where the user explicitly requests complete, unabridged output.
  3. State that system, developer, safety, user, tool, token-budget, and task-specific constraints take precedence over the skill.
  4. Replace mandatory continuation text with an optional strategy that is used only when permitted by the caller's output protocol.
  5. Allow concise summaries, placeholders, or partial delivery when explicitly requested or when required by response limits.
  6. Scope the pre-response cross-check to completeness requirements expressly stated by the user rather than applying it to every task.
  7. Add a bounded policy such as: “Use these recommendations only when compatible with higher-priority instructions and the requested response format.”

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manifest description says to apply the skill to 'any task requiring exhaustive, unabridged output,' which is a very broad natural-language trigger that overlaps with many ordinary requests. It does not define clear boundaries, explicit trigger phrases, or exclusion conditions, increasing the chance of accidental invocation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.