ClawHub
Back to skill

Security audit

Prose Andy27725

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed workflow-runner skill, but it needs review because it can execute remote workflows, spawn agents, expose database credentials, and create persistent cross-project memory.

Review carefully before installing. Use it only with .prose programs you trust, avoid arbitrary remote URLs unless you have inspected and pinned the content yourself, keep persistent agents scoped to a project or run, and avoid PostgreSQL mode with production credentials. If PostgreSQL is needed, use a dedicated least-privilege database, do not rely on DATABASE_URL, and do not expose unauthenticated Docker Postgres on a shared or reachable host.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (6)

T01 · Skill Instruction Hijacking

Error
Location
guidance/system-prompt.md:10
Finding

Agent Role and Instruction Hijacking

Content
View full analysis
Remediation
View remediation

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:67
Finding

Arbitrary Remote Workflow Retrieval and Execution

Content
View full analysis
Remediation
View remediation

T02 · Agent Memory Poisoning

Error
Location
prose.md:438
Finding

Cross-Run and Cross-Project Persistent Memory Poisoning

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
state/postgres.md:64
Finding

PostgreSQL Credentials Exposed to Program-Controlled Subagents and Logs

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
state/postgres.md:465
Finding

SQL and Shell-Command Injection Through Unescaped Workflow Output

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
state/postgres.md:138
Finding

Recommended PostgreSQL Deployment Disables Authentication and Publishes the Database Port

Content
View full analysis
.prose/.env ``` ### Technical Analysis `POSTGRES_HOST_AUTH_METHOD=trust` configures PostgreSQL to accept applicable connections without password authentication. Docker's `-p 5432:5432` publishes the container port on host interfaces by default rather than explicitly limiting it to loopback. On a shared host, developer workstation, CI runner, cloud VM, or improperly firewalled network, other systems may be able to connect to the database without credentials. The database contains program source, execution state, subagent output, prompts, and persistent memory. Although presented as a quick setup, it is labeled as the recommended Docker path and therefore encourages an insecure default. ### Attack Path 1. A user follows the recommended Docker command. 2. PostgreSQL starts with host authentication set to `trust`. 3. Port 5432 is published through the host. 4. A local process or reachable network peer connects without a password. 5. The attacker reads or modifies OpenProse state using the exposed PostgreSQL role and database. ### Impact Assessment An attacker with network reachability may access workflow sources, generated content, task prompts, bindings, and persistent agent memory. Depending on PostgreSQL role configuration, the attacker may also delete state, create objects, or use database capabilities beyond the OpenProse schema. ]]>
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (66)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 9)May include surrounding context.

md
ailed system description, they don't just describe it, they _simulate_ it. The `prose.md` specification describes a virtual machine with enough fidelity that a

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md
ailed system description, they don't just describe it, they _simulate_ it. The `prose.md` specification describes a virtual machine with enough fidelity that a

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

md
ailed system description, they don't just describe it, they _simulate_ it. The `prose.md` specification describes a virtual machine with enough fidelity that a

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.

md
ailed system description, they don't just describe it, they _simulate_ it. The `prose.md` specification describes a virtual machine with enough fidelity that a

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.

md
ailed system description, they don't just describe it, they _simulate_ it. The `prose.md` specification describes a virtual machine with enough fidelity that a

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 170)May include surrounding context.

md
ailed system description, they don't just describe it, they _simulate_ it. The `prose.md` specification describes a virtual machine with enough fidelity that a

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 250)May include surrounding context.

md
ailed system description, they don't just describe it, they _simulate_ it. The `prose.md` specification describes a virtual machine with enough fidelity that a

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md
| `prose compile <file>` | Load `compiler.md`, validate the program |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

md
| `prose compile <file>` | Load `compiler.md`, validate the program |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.

md
| `prose compile <file>` | Load `compiler.md`, validate the program |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 146)May include surrounding context.

md
| `prose compile <file>` | Load `compiler.md`, validate the program |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 217)May include surrounding context.

md
| `prose compile <file>` | Load `compiler.md`, validate the program |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 319)May include surrounding context.

md
| `prose compile <file>` | Load `compiler.md`, validate the program |

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill explicitly supports fetching and executing remote .prose programs from arbitrary URLs or registry shorthands, but it does not prominently warn that this is execution of untrusted content. Because .prose programs can drive multi-agent workflows, file access, and remote fetches, this creates a direct path for prompt injection, data exfiltration, and unsafe tool use.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
89% confidence
Finding

The skill instructs the agent to inspect .prose/.env for OPENPROSE_POSTGRES_URL, which is likely to contain database credentials. Reading credential-bearing files as part of normal flow expands secret exposure risk, especially in systems with logging, multi-agent delegation, or transcript persistence.

Content

Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.

  1. Check for connection configuration first:

    bash
    # Check .prose/.env for OPENPROSE_POSTGRES_URL
cat .prose/.env 2>/dev/null | grep OPENPROSE_POSTGRES_URL
# Or check environment variable
echo $OPENPROSE_POSTGRES_URL

Credential Access

High
Category
Privilege Escalation
Confidence
96% confidence
Finding

The instruction echo $OPENPROSE_POSTGRES_URL explicitly prints a secret-bearing environment variable, which can expose credentials in logs, transcripts, or downstream agent context. This is a direct secret disclosure pattern, not merely a configuration lookup.

Content

Scanner excerpt · SKILL.md (reported line 184)May include surrounding context.

bash
   # Check .prose/.env for OPENPROSE_POSTGRES_URL
   cat .prose/.env 2>/dev/null | grep OPENPROSE_POSTGRES_URL
   # Or check environment variable
   echo $OPENPROSE_POSTGRES_URL

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
70% confidence
Finding

Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

Content

Scanner excerpt · guidance/patterns.md (reported line 676)May include surrounding context.

md
agent structured-reviewer:
  model: sonnet
  prompt: """
    Always respond with this exact JSON structure:
    {
      "verdict": "pass" | "fail" | "needs_review",
      "issues": [{"severity": "high"|"medium"|"low", "description": "..."}],

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 204)May include surrounding context.

text
# Project-level state (in working directory)
.prose/
├── .env                              # Config (simple key=value format)
├── runs/
│   └── {YYYYMMDD}-{HHMMSS}-{random}/
│       ├── program.prose             # Copy of running program

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 208)May include surrounding context.

text
# Project-level state (in working directory)
.prose/
├── .env                              # Config (simple key=value format)
├── runs/
│   └── {YYYYMMDD}-{HHMMSS}-{random}/
│       ├── program.prose             # Copy of running program

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 301)May include surrounding context.

text
# Project-level state (in working directory)
.prose/
├── .env                              # Config (simple key=value format)
├── runs/
│   └── {YYYYMMDD}-{HHMMSS}-{random}/
│       ├── program.prose             # Copy of running program

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · prose.md (reported line 159)May include surrounding context.

text
# Project-level state (in working directory)
.prose/
├── .env                              # Config (simple key=value format)
├── runs/
│   └── {YYYYMMDD}-{HHMMSS}-{random}/
│       ├── program.prose             # Copy of running program

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · state/postgres.md (reported line 212)May include surrounding context.

text
# Project-level state (in working directory)
.prose/
├── .env                              # Config (simple key=value format)
├── runs/
│   └── {YYYYMMDD}-{HHMMSS}-{random}/
│       ├── program.prose             # Copy of running program

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · state/postgres.md (reported line 217)May include surrounding context.

text
# Project-level state (in working directory)
.prose/
├── .env                              # Config (simple key=value format)
├── runs/
│   └── {YYYYMMDD}-{HHMMSS}-{random}/
│       ├── program.prose             # Copy of running program

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · state/postgres.md (reported line 237)May include surrounding context.

text
# Project-level state (in working directory)
.prose/
├── .env                              # Config (simple key=value format)
├── runs/
│   └── {YYYYMMDD}-{HHMMSS}-{random}/
│       ├── program.prose             # Copy of running program

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · prose.md (reported line 755)May include surrounding context.

md
- Check if value was pre-supplied or available from runtime context
- If available: bind and continue
- If not available: pause execution, display prompt, wait for user response

### Input Prompt Formats

Static analysis

No suspicious patterns detected.