ClawHub
Back to skill

Security audit

Threshold Keel

Security checks for vulnerabilities and agentic risk

Overview

This skill is a safety guardrail, but it takes broad control over agent actions and can automatically log or sync activity through an external CLI, so it needs review before use.

Install only if you want a session-wide safety gate that may block or slow ordinary write actions. Prefer local-only use first, verify the threshold-keel package source/version before installing, avoid setting KEEL_CLOUD_API_KEY unless you accept cloud storage of action logs, and understand that disabling the skill is documented as removing the skill file rather than issuing a chat command.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:34
Finding

Unscoped and Non-Disableable Agent Instruction Hijacking

Content
View full analysis
Remediation
View remediation

other

Error
Location
SKILL.md:126
Finding

Automatic Cloud Synchronization of Broad Activity Logs

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:15
Finding

Unpinned and Unauditable Executable Package Dependency

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

md
canonical WAL formatting, or guaranteed forward compatibility with CLI/Cloud
features.** It is a behavioural safety layer, not a durable state system.

**Do not create `~/.keel/` directories, `store.json`, or WAL files in
instructions mode.** The CLI owns that state and creates it in a canonical
format via `keel init`. Agent-created files in `~/.keel/` may be incompatible
with the CLI and will cause verification failures if the user later installs it.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

md
| Show quarantine | Inspect directories | `keel quarantine` |
| Restore item | Move files back | `keel restore --item-id ITEM_ID` |

The `--action-file` flag is the preferred way to pass action JSON -- write the
JSON to a temp file and pass the path. This avoids shell quoting issues across
platforms. The `--action-json` and `--payload` flags also accept inline JSON
strings or `@filepath` references (e.g. `--payload @/tmp/action.json`).

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 410)May include surrounding context.

md
Type "keel status" for details.
     ```
3. If CLI not available:
   - Do NOT create `~/.keel/` directories or files
   - Greet:
     ```
     🦞🔒 Keel active (instructions mode). Behavioural guardrails are live.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

This markdown file explicitly lists user phrases that invoke skill behavior, including generic variants like "keel log", "keel wal", and especially natural-language forms such as "keel add policy [desc]" and "keel restore [item]". While prefixed with "keel," the file does not provide negative examples or boundary conditions clarifying when similar conversational mentions should not trigger command handling, which could lead to unintended invocation in ordinary discussion about Keel.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.