ClawHub
Back to skill

Security audit

masterplan-executor

Security checks for vulnerabilities and agentic risk

Overview

The skill is a transparent project-building workflow with expected local code changes, testing, web research, and progress logging, but users should understand those actions before using it on sensitive projects.

Use this skill when you want an agent to actively build a project from an existing masterplan. Before installing, be comfortable with it reading and changing the project, running tests or app code, creating a persistent execution log, possibly making local commits, and performing automatic web searches to resolve ambiguity. For private or regulated codebases, set explicit instructions or environment controls if web access should be restricted.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README repeatedly advertises automatic web searching whenever the plan is ambiguous, but it does not give a clear user-facing disclosure that external network access may occur and project context may be transmitted to outside services. In an execution skill operating on potentially sensitive codebases, undisclosed outbound research increases the risk of data leakage, compliance violations, and unexpected external side effects.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README suggests the example trigger phrase "build this," which is common everyday language and not narrowly scoped to this specific skill. Because the description does not provide exclusion conditions or clearer trigger constraints, this could overlap with unrelated user requests and lead to accidental activation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill's activation language is broad enough to match ordinary requests like 'build this' or 'continue where we left off', which can cause the agent to enter a high-autonomy implementation workflow when the user did not explicitly consent to that mode. In context, this is more dangerous because the skill can read plans, modify code, run tests, and perform web research, so accidental invocation expands both action scope and data exposure.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
95% confidence
Finding

The instruction to perform external research 'without asking the user's permission first' authorizes autonomous behavior that can disclose sensitive context and make architecture-impacting choices before the user approves the action. Given this skill's role as an executor with authority to inspect the codebase, resume prior state, run code, and persist logs, that autonomy materially increases the risk of data leakage, unintended external communication, and unauthorized decision-making.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md
Follow `references/phase-execution-checklist.md` for the mechanical steps. For each phase, in strict roadmap order:

1. **Re-read the plan sections that scope this phase** — the relevant features with their acceptance criteria, tech-stack entries, data-model pieces, API contract, adaptive-system requirements, and the specific production-readiness items that apply to this phase's surface area.
2. **Resolve ambiguity via research, automatically, never via guessing.** If anything needed to implement this phase correctly is unclear, underspecified, contradicts something else in the plan, or the plan's stated approach seems outdated or wrong now that you're actually implementing it — `web_search` (and `web_fetch` official docs/changelogs/release notes) to find the current, valid, correct way to do it before writing the code. This covers: exact current API/syntax of a chosen library or framework, current security best practice for a specific mechanism, resolving an internal contradiction in the plan, or confirming a version/approach is still the right one. Do this without asking the user's permission first — it's the default behavior, not an escalation. Only surface it to the user afterward if the research changes something user-facing or a major architecture decision (see Phase 3).
3. **Implement to the standard in `references/execution-standards.md`** — real error handling, real config/secrets management, real input validation, real structured logging, environment-adaptive behavior wherever the plan calls for it, no dead code, no silent failures. Not a version "to be hardened later" — the version that ships. If this step is done surgically via subagents/parallel workers, gate concurrency per `references/resource-safety.md` — recompute the safe concurrency budget from freshly detected available RAM before spawning each batch, never from a fixed number or a prior session's reading. When in doubt or detection is unavailable, execute sequentially instead of risking an OOM.

...[truncated 25 chars]

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill explicitly instructs automatic web_search/web_fetch without first warning the user in the skill description, which can send project-derived queries to third-party services without informed consent. In this context, the danger is elevated because implementation ambiguities may include proprietary architecture details, dependency versions, internal error messages, or security mechanisms that should not be externally disclosed by default.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill states that it maintains a persistent execution log, but the README does not prominently warn users that it will write and update project files across sessions. In a build/execution context, undisclosed persistent writes can surprise users, create unwanted artifacts in repositories, and potentially record sensitive implementation details in version-controlled locations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.