ClawHub
Back to skill

Security audit

anti-slop

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed writing and code self-editing aid with a local diagnostic script and no evidence of hidden access, persistence, exfiltration, or destructive behavior.

Install this if you want the agent to routinely apply a style and code-quality self-edit pass before delivering larger outputs. Be aware it may change tone, formatting, or code structure proactively, so review final outputs when preserving exact wording, voice, or implementation style matters.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The code substantially overlaps with part of the description: it does detect likely AI-sounding prose features such as stock vocabulary, structural phrases, bullet-heavy formatting, excessive bold, and em-dash usage. However, the description presents a broader remediation skill that both detects and removes slop across prose and code, and that proactively triggers in many contexts. The supplied code does not rewrite, clean, or remove anything; it only produces a diagnostic report. It also does not inspect code anti-patterns like swallowed errors, hallucinated APIs, dead code, or over-engineering. Finally, there is no implementation of proactive triggering behavior—just a standalone CLI that reads a file or stdin and prints text or JSON. These are material differences in primary behavior and capabilities, so this should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill uses very broad proactive activation language ('use this proactively' on substantial prose or non-trivial code), which can cause it to trigger across many normal tasks without explicit user request. In context, that broad scope is less about data exfiltration and more about unwanted interference: it may overwrite user tone, alter code unnecessarily, or steer outputs away from task requirements under the guise of a mandatory self-edit pass.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.