ClawHub
Back to skill

Security audit

Error Recovery

Security checks for vulnerabilities and agentic risk

Overview

This error-recovery skill is coherent overall, but it gives agents under-scoped authority to persist detailed error logs and modify future workflows or agent guidance.

Review this skill before installing if you do not want agents to write persistent error logs, edit AGENTS.md or skill/workflow guidance, or try alternate authentication paths. It is not clearly malicious, but it should be constrained to actual task failures and should require approval before using credentials, elevated permissions, package installs, or persistent memory updates.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (11)

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

The instruction to 'Update skill/workflow' after recurring errors encourages self-modification of agent behavior based on runtime events. In agent environments, autonomous prompt or workflow mutation can persist mistakes, encode adversarial conditions into future behavior, or bypass normal review and change-control safeguards.

Content

Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.

md
□ Could this happen again?
  → Add guard for this case
  → Update skill/workflow

□ Is there a systemic issue?
  → Suggest process improvement

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill description is written in Chinese throughout, including the title, problem statement, and usage guidance, with no indication that other languages are supported or that the Chinese-only presentation is required for a region-specific purpose. This can violate language/locale policy where skills should not force a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The description declares activation on very broad phrases like 'error', 'failed', and 'retry', which are common in ordinary conversation, logs, and benign text. In agent systems, such loose triggers can cause the skill to activate unexpectedly, altering behavior in the wrong context and potentially driving unnecessary recovery actions.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md
**Anti-patterns:**
- ❌ Command failed, but I continue anyway
- ❌ Error logged, but not mentioned in my response
- ❌ "Probably fine" without verification

**What to do:**
1. Stop and acknowledge the error

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The skill is described as an error recovery framework focused on recognizing, rescuing, reporting, and remembering errors. However, suggesting or performing dependency installation is a substantive system-modification capability, and later guidance to 'try using token auth' implies credentialed remote access behavior; neither capability is inherently justified by a generic recovery framework description.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The example suggests the agent 'will try using token auth' after a GitHub authentication failure, which introduces credentialed remote-access behavior beyond passive error reporting. In an autonomous agent context, this can normalize attempting alternate authentication flows without explicit user approval and may lead to unsafe credential handling or unexpected outbound actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill instructs persistent logging of full error details to disk, including context, root cause, and potentially sensitive command output, without any minimization or consent safeguards. Error messages often contain secrets, file paths, prompts, tokens, or personal data, so unconditional persistence creates a clear confidentiality risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger list is ambiguous, multilingual, and lacks contextual boundaries, making accidental activation likely when users merely discuss errors rather than experiencing one. In an agent setting, this raises the chance of inappropriate retries, state changes, or disruptive detours from the intended workflow.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file’s header, usage text, and all diagnostic output are written in Chinese, indicating the tool is designed to operate in a single language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/error-diagnose.mjs (reported line 26)May include surrounding context.

js
quickFix: '检查chmod权限，或尝试sudo',
    suggestions: [
      '检查文件权限: ls -la',
      '修改权限: chmod 644/600',
      '切换到正确用户组',
      '使用sudo（慎用）'
    ]

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The trigger list mixes English and Chinese phrases, but the document does not explain whether multilingual triggering is optional, user-configurable, or limited to a particular locale. This can create an implicit language-policy issue because activation behavior is expanded to another language without explicit opt-in or justification.

Content

No source excerpt is available for this finding.