Security audit

Skill Cortex

Security checks for vulnerabilities and agentic risk

Overview

This skill is purpose-aligned as an on-demand skill manager, but its reflex mode and third-party skill acquisition give it too much authority without consistently requiring affirmative user review.

Install only if you are comfortable with an agent searching for, installing, executing, and uninstalling third-party skills on your behalf. Prefer disabling or avoiding reflex mode, require affirmative approval for every install and execution plan, and avoid unreviewed GitHub-sourced skills unless you manually inspect the package first.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:42
Finding: Reflex Mode Permits Third-Party Skill Installation and Execution Without Explicit Approval
Content: View full analysis
= 0.90 AND consecutive successes >= 5 - **No write side effects** (side_effects contains no `write:`/`delete:`/`shell:` prefix) - **Version unchanged** (slug + version match the stored record) Reflex mode **skips only the execution plan confirmation**. Installation still requires user notification: ``` ⚡ Skill Cortex reflex: todoist-cli v1.2.0 (96% success rate) Task: query today's todos (read-only) | Will install and execute. Say cancel to abort. ``` ``` ```markdown ### 3.2 Execution Plan Read the installed Skill's SKILL.md and present to the user: - Step summary - Side-effect severity: 🟢 read-only 🟡 write 🔴 destructive 🔑 sensitive credentials ⚙️ shell commands - Relevant prefrontal lessons (if any) — e.g., proactively check for a dependency known to be commonly missing **Reflex mode skips this step. Standard mode waits for user confirmation.** ``` ```markdown 2. Installation requires user confirmation (including reflex mode). 3. System dependency installation requires separate confirmation. 4. Write operations never enter reflex. Reflex locks version; version change auto-downgrades. ``` ### Technical Analysis The reflex workflow treats a notification followed by the absence of cancellation as authorization to install and execute a third-party Skill. This is an opt-out mechanism rather than explicit user confirmation. The behavior contradicts the boundary rule stating that installation requires user confirmation, including in reflex mode. It also bypasses the execution-plan confirmation, preventing the user from reviewing the installed Skill's actual instructions and side effects before e ...[truncated 1569 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:30
Finding: Unreviewed Third-Party Skills May Be Selected, Installed, and Executed
Content: View full analysis
"`. Read summaries only, pick up to **3** candidates. If fewer than 2 relevant results, supplement with a GitHub search (mark as unreviewed source). ``` ```markdown ### Standard Mode Present candidates to the user (name, description, stars, downloads, source, security scan status, history). **Wait for explicit approval before installing.** If `prefrontal.lessons` contain experiences matching the current region, retain them for use in Phase 3. --- ## Phase 3: Execution ### 3.1 Install ```bash clawhub install ``` On failure, auto-switch to the next candidate. Max **2** switches, then stop and report. ### 3.2 Execution Plan Read the installed Skill's SKILL.md and present to the user: - Step summary - Side-effect severity: 🟢 read-only 🟡 write 🔴 destructive 🔑 sensitive credentials ⚙️ shell commands - Relevant prefrontal lessons (if any) — e.g., proactively check for a dependency known to be commonly missing ``` ```markdown ### 3.3 Execute Follow the Skill's instructions to complete the task. ``` ### Technical Analysis Candidate selection is based on registry summaries rather than inspection of the complete package. When ClawHub returns too few relevant results, the workflow explicitly permits GitHub candidates marked as unreviewed. Although candidate metadata and security-scan status are shown to the user, the instructions do not require rejection when a scan is absent, stale, inconclusive, or failed. They also do not require publisher verification, cryptographic signatures, immutable hashes, repository ownership validation, or package-content inspection before installation. After installation, the agent is instructed to follow the downloaded ...[truncated 1372 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:42
Finding: Reflex Eligibility Allows Credential Reads and Network Access Without Plan Confirmation
Content: View full analysis
= 0.90 AND consecutive successes >= 5 - **No write side effects** (side_effects contains no `write:`/`delete:`/`shell:` prefix) - **Version unchanged** (slug + version match the stored record) Reflex mode **skips only the execution plan confirmation**. Installation still requires user notification: ``` ```markdown ### 4.4 Reflex Promotion Set `reflex: true` when ALL conditions are met: success >= 5, weight >= 0.90, no write side effects. Immediately reset `reflex: false` on any failure or version change. ``` ```jsonc "side_effects": [ "read:env:TODOIST_API_KEY", "network:api.todoist.com" // write-op prefixes: "write:", "delete:", "shell:" // Skills with these prefixes can NEVER enter reflex mode ], ``` ```markdown ### Promotion Conditions (ALL must be met) 1. `runs.success >= 5` 2. `weight >= 0.90` 3. `side_effects` contains no `write:`, `delete:`, or `shell:` prefix 4. Current `reflex == false` ### Reflex Safety Boundaries - Reflex skips only the "execution plan confirmation", never the "installation notification" - If the user says "cancel" after a reflex notification, abort immediately - Skills with write operations can never enter reflex, regardless of weight ``` ### Technical Analysis The reflex safety test excludes only side-effect tags beginning with `write:`, `delete:`, or `shell:`. The documented schema explicitly demonstrates a candidate with both `read:env:TODOIST_API_KEY` and `network:api.todoist.com`, neither of which blocks reflex promotion. Credential reads and outbound network access form a direct data-exfiltration capability even when no write, delete, or s ...[truncated 1722 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 50)May include surrounding context.
md
- **Entity filtering**: signal words are stripped of personal data before storage - **Synaptic pruning**: stale routes and low-confidence lessons are automatically cleaned up - **Failure recovery**: auto-retry, candidate switching, and structured error reporting - **Safety-first**: write operations never enter reflex; all installs require user consent ## Installation

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger condition 'when installed Skills cannot complete the current task' combined with 'If you can handle it yourself, just do it — do not trigger this flow' is subjective and under-specified, leaving broad discretion to invoke this meta-skill. Because this skill can search external sources, install new skills, and later execute them, an overly broad activation boundary materially increases the chance of unnecessary acquisition and execution of untrusted capabilities.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.