ClawHub
Back to skill

Security audit

Liveview Code Review

Security checks for vulnerabilities and agentic risk

Overview

The skill is a normal LiveView review checklist, but it requires loading an unbundled sibling skill outside the reviewed package.

Install only if you trust the adjacent review-verification-protocol skill that your agent will load, or ask the publisher to bundle or pin that protocol inside this package. The LiveView guidance itself appears purpose-aligned and non-executable, but the external instruction dependency should be reviewed carefully.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:110
Finding
Mandatory Loading of an Untrusted Cross-Skill Instruction Dependency<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:110` **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: Medium ### Vulnerable Code ```markdown | **G2 — Verification protocol** | You loaded [review-verification-protocol](../review-verification-protocol/SKILL.md) and applied its Pre-Report Verification (and issue-type sections where relevant) **before** treating something as a finding. | ``` ### Technical Analysis The Skill requires the agent to load and follow instructions from `../review-verification-protocol/SKILL.md`, a sibling path outside the audited package. That external Skill is not bundled or pinned to verified content, so its integrity cannot be established from this project. Making this external instruction source a mandatory gate allows whoever controls the sibling path to influence the agent's review procedure. Malicious instructions could alter evaluation criteria, suppress legitimate findings, redirect the task, or attempt to weaken safety constraints. The dependency is unnecessary for the Skill's declared Phoenix LiveView review functionality because its local documentation already contains review rules and checklists. The audit also examined `references/security.md`, `references/assigns-streams.md`, `references/components.md`, and `references/lifecycle.md`. The sensitive-looking values in `references/security.md` are inert examples in fenced code blocks; no network client, external destination, or executable data-transmission path was found. The pre-scan network warning is therefore a false positive. ### Attack Path 1. An attacker gains the ability to create or modify `../review-verification-protocol/SKILL.md`. 2. The audited Skill is loaded to perform a LiveView code review. 3. Gate G2 directs the agent to load the attacker-controlled sibling Skill before reporting findings. 4. The sibling Skill supplies malicious or misleading review instructions. 5. The agent applies those instructions, potenti ...[truncated 681 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Remove the mandatory dependency on `../review-verification-protocol/SKILL.md` and make the bundled review criteria self-contained. 2. If the protocol is required, include a reviewed copy inside this package and reference it using a package-local path. 3. Pin trusted external content to a verified version and validate its cryptographic hash before use. 4. Treat externally loaded Skill text as untrusted data and prevent it from overriding system instructions, safety constraints, user intent, or evidence-based reporting. 5. Define deterministic local behavior for cases where the verification protocol is missing or fails integrity validation; the Skill should fail closed rather than loading arbitrary replacement instructions. 6. Re-audit the bundled or pinned verification protocol as part of this Skill's security boundary. ]]>

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.