ClawHub
Back to skill

Security audit

operations-expert

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent content-operations helper with local reference files and simple optional validation scripts, and I found no hidden data access, persistence, network behavior, or destructive actions.

Install this if you want an agent to help plan, adapt, and review publishable content across platforms. Be aware it may read its packaged strategy references and can process local files you provide to its helper scripts, so only point it at source notes you intend to use for content work.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
The declared description presents a content strategy and content creation/adaptation skill, but the supplied code does not perform any content analysis, generation, platform adaptation, planning, or optimization. Instead, it only loads schema definitions from a local JSON config file, checks whether an input JSON document contains required fields, and exits with validation results. This is a materially different primary purpose: structured output validation rather than content operations. No suspicious extra resource access is present, but the implemented capability is unrelated to the declared description.

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill instructs the agent to read local reference and template files and to invoke helper scripts, but it declares no explicit tool scope or permissions boundary. In systems that rely on manifest-declared capabilities for least privilege, this creates an unnecessary file-read surface and makes it easier for the skill to access unintended workspace content if routing or guardrails are loose.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The activation text is very broad ('use when chatgpt needs to...' across many common content tasks), which can cause the skill to trigger for a wide range of ordinary prompts. Over-broad routing increases the chance that the model unnecessarily loads this skill and its file-reading behavior in contexts where it is not needed, expanding exposure to prompt injection in skill files and unintended data access.

Static analysis

No suspicious patterns detected.