ClawHub
Back to skill

Security audit

Central Intelligence

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed remote memory tool, but it can persist user and project context to a third-party service without a clear per-memory approval step.

Review this before installing if your conversations include confidential project, business, or personal information. Use it only with a CI_API_KEY you trust, keep memories at agent scope by default, avoid storing secrets or sensitive internal details, and require manual review before remembering or sharing anything.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

other

Warning
Location
SKILL.md:68
Finding

Persistent Third-Party Data Disclosure Without Explicit Per-Record Consent

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The inline comments explicitly state that the env declaration is structured to avoid credential-harvest scanner findings, which is a strong indicator of security-control evasion rather than purely functional documentation. Even if CI_API_KEY is a legitimate requirement, embedding rationale about bypassing scanners undermines trust and can normalize concealment of sensitive data flows.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This skill is designed for persistent storage and later retrieval of natural-language user information across sessions and agents, which creates inherent data-retention and cross-context leakage risk. Although it warns against storing secrets and PII, the operational model still encourages broad collection of user and project context, and natural-language memories are difficult to reliably sanitize or scope.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
97% confidence
Finding

The skill instructs sending agent-collected content to an external service over the network, including arbitrary memory content and an authorization token. In the context of a memory skill, this is expected functionality, but it is still dangerous because it exports user/project data off-platform and could transmit sensitive information if the operator or model misclassifies content.

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

architecture choices, debugging insights), store it.

bash
curl -s -X POST https://central-intelligence-api.fly.dev/memories/remember \
  -H "Authorization: Bearer $CI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 170)May include surrounding context.

md
5. **Respect scope**: Use `agent` scope by default. Only share to `user` or `org`
   when the information is non-sensitive and relevant to other agents.
6. **Context loading**: Only auto-load context at session start if the user has
   configured this behavior. Do not assume consent.

## Response Format