ClawHub
Back to skill

Security audit

Write Plan

Security checks for vulnerabilities and agentic risk

Overview

This skill is a planning helper that reads a spec and related project files, writes a plan only after user approval, and does not execute the implementation.

Install if you want a structured planning workflow. Expect it to read the relevant spec, repository conventions, and code patterns, and to create a plan file only after approval. Review the generated plan before using it to execute work, especially because it may contain exact test, git, and migration commands for a later executor.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

└─ Approved? → Write to plan.md

text

**The terminal state is a written plan.** This skill does not execute the plan, run tests, or modify production code. After writing, it asks whether to generate an execution handoff prompt and, on yes, loads the **subagent-prompt** skill ([../../../beagle-core/skills/subagent-prompt/SKILL.md](../../../beagle-core/skills/subagent-prompt/SKILL.md)) to produce one in this session; otherwise it tells the user the plan is ready.

## Locating the Spec

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 419)May include surrounding context.

└─ Approved? → Write to plan.md

text

**The terminal state is a written plan.** This skill does not execute the plan, run tests, or modify production code. After writing, it asks whether to generate an execution handoff prompt and, on yes, loads the **subagent-prompt** skill ([../../../beagle-core/skills/subagent-prompt/SKILL.md](../../../beagle-core/skills/subagent-prompt/SKILL.md)) to produce one in this session; otherwise it tells the user the plan is ready.

## Locating the Spec

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 428)May include surrounding context.

└─ Approved? → Write to plan.md

text

**The terminal state is a written plan.** This skill does not execute the plan, run tests, or modify production code. After writing, it asks whether to generate an execution handoff prompt and, on yes, loads the **subagent-prompt** skill ([../../../beagle-core/skills/subagent-prompt/SKILL.md](../../../beagle-core/skills/subagent-prompt/SKILL.md)) to produce one in this session; otherwise it tells the user the plan is ready.

## Locating the Spec

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/plan-template.md (reported line 181)May include surrounding context.

md
| Code block with `// TODO` or `unimplemented!()` as final state | Behavior contract with specific bullets; no placeholder code |
| "Similar to Task 2" with no further information | A `Patterns` reference, plus the task's own files, test code, and commit |
| Test asserting `the handler was called` | Test asserting `the row appears in storage` / `the file is written` / `the next request returns the new state` |
| Test invents `fn make_test_user()` without checking the codebase | Test uses existing `factories::user()` / `fixtures::user()`; or, if absent, the plan names the existing factories that were considered and why none fit |
| 12 boundary tests for one parser ("empty, single char, leading whitespace, trailing whitespace, only whitespace, unicode emoji, BOM, …") | One test per spec-required behavior; one test per named bug class from the Assumption Audit. Speculative inputs go to a fuzz harness if one exists, otherwise omit. |
| Task refactor lands but file still has `// returns the old PG pool` comments referring to the deleted field | Sweep step in the same task removes the orphaned comment alongside the impl change |
| Test body: 60 lines of imports + 5-iteration seeding loop + 6 assertions across 4 follow-on queries | Test body: ~12 lines — one helper call to seed, the call site under test, 2-3 assertions on observable consequence. Setup is recovered from existing types and helpers. |

Static analysis

No suspicious patterns detected.