ClawHub
Back to skill

Security audit

Strategy Review

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently reviews strategy documents and writes local review artifacts, with no hidden code, network behavior, or credential access found.

Before installing, consider whether the strategy documents you review contain sensitive business information. The skill appears safe for normal local use, but long or judge-mode reviews can leave review notes and JSON artifacts in a .beagle directory, so clean that state if you do not want retained copies.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Memory Manipulation

High
Category
Memory Poisoning
Content
Read the full document. Identify (or note the absence of) the three kernel elements:

1. **Diagnosis** — What does the document say is actually going on? Is there a clear statement of the challenge?
2. **Guiding policy** — What overall approach has been chosen? Does it make a directional choice?
3. **Coherent actions** — What concrete steps carry out the policy? Do they reinforce each other?
Confidence
80% confidence
Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Memory Manipulation

High
Category
Memory Poisoning
Content
Read the full document. Identify (or note the absence of) the three kernel elements:

1. **Diagnosis** — What does the document say is actually going on? Is there a clear statement of the challenge?
2. **Guiding policy** — What overall approach has been chosen? Does it make a directional choice?
3. **Coherent actions** — What concrete steps carry out the policy? Do they reinforce each other?
Confidence
80% confidence
Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
- **The comfortable diagnosis**: Identifies a challenge that the organization already knows how to solve, avoiding the harder truth that requires a different approach.
- **The diagnosis-by-data-dump**: Presents extensive market research and trend analysis but never synthesizes it into a judgment. The reader is left to figure out what it all means.
- **The inherited diagnosis**: Repeats the diagnosis from last year's strategy without checking whether the underlying situation has changed.
- **The consensus diagnosis**: So carefully worded to avoid offending any stakeholder that it says nothing specific. Usually produced by committee.

**Lens connection — Competitive Pressure Audit**: When the diagnosis addresses competitive dynamics, apply Five Forces thinking from `references/review-lenses.md`. Check whether the diagnosis accounts for all five forces (rivalry, new entrants, substitutes, supplier power, buyer power) or focuses narrowly on direct rivalry while ignoring structural pressures that could reshape the competitive environment. A diagnosis that says "we're losing to Competitor X" but doesn't consider substitution risk or eroding entry barriers has only seen part of the picture.
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
- **The comfortable diagnosis**: Identifies a challenge that the organization already knows how to solve, avoiding the harder truth that requires a different approach.
- **The diagnosis-by-data-dump**: Presents extensive market research and trend analysis but never synthesizes it into a judgment. The reader is left to figure out what it all means.
- **The inherited diagnosis**: Repeats the diagnosis from last year's strategy without checking whether the underlying situation has changed.
- **The consensus diagnosis**: So carefully worded to avoid offending any stakeholder that it says nothing specific. Usually produced by committee.

**Lens connection — Competitive Pressure Audit**: When the diagnosis addresses competitive dynamics, apply Five Forces thinking from `references/review-lenses.md`. Check whether the diagnosis accounts for all five forces (rivalry, new entrants, substitutes, supplier power, buyer power) or focuses narrowly on direct rivalry while ignoring structural pressures that could reshape the competitive environment. A diagnosis that says "we're losing to Competitor X" but doesn't consider substitution risk or eroding entry barriers has only seen part of the picture.
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
For formal or file-output reviews, produce one file: `strategy-review.md`. Write it in the user's working directory unless they specify otherwise. If the user asked for quick feedback or a chat-only take, deliver findings inline instead — see the chat-only branch in SKILL.md Step 5. This template applies only when file output is confirmed.

The tone is direct and specific. Every finding must point to evidence in the document. Every recommendation must be concrete enough that the author can act on it without asking "but what specifically should I do?"

---
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
For formal or file-output reviews, produce one file: `strategy-review.md`. Write it in the user's working directory unless they specify otherwise. If the user asked for quick feedback or a chat-only take, deliver findings inline instead — see the chat-only branch in SKILL.md Step 5. This template applies only when file output is confirmed.

The tone is direct and specific. Every finding must point to evidence in the document. Every recommendation must be concrete enough that the author can act on it without asking "but what specifically should I do?"

---
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Low
Confidence
85% confidence
Finding
The skill instructs dual-writing `strategy-review.json` to both the working directory and a durable review state directory, and even validating by reading both copies, but does not require a user-facing disclosure or consent for that extra persistence. This creates an unexpected data-retention and information-exposure risk, especially if strategy documents or notes contain sensitive business information and the durable state directory is longer-lived or differently permissioned than the user expects.

Static analysis

No suspicious patterns detected.