ClawHub
Back to skill

Security audit

Dishwasher Buying Consultant

Security checks for vulnerabilities and agentic risk

Overview

This is a pure instruction-based dishwasher buying guide that asks clarifying questions and gives purchase research advice, without hidden code, persistence, or system access.

This skill appears safe to install from a security perspective. Users should still treat product suggestions as research starting points and verify current availability, pricing, electrical compatibility, dimensions, and installation requirements before buying.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · README.md (reported line 13)May include surrounding context.

md
1. Agent interviews the user with targeted, research-backed question groups covering: household size and load frequency, installation space and form factor, plumbing and water supply, electrical infrastructure, water hardness, noise sensitivity, programme needs, and long-term intent
2. Applies verified industry standards — IEC 60436 place-setting definition and capacity sizing rules, EU A–G energy label per-cycle kWh and litre benchmarks, IEC 60704-2-3 noise test reference, water hardness °dH thresholds for softener requirement, drying method comparison, and programme duration ranges
3. Proactively flags common buyer mistakes: measuring only width and ignoring depth, selecting capacity by place-setting count without checking rack flexibility, skipping a built-in softener in hard-water areas, ignoring dB(A) rating for open-plan kitchens, integrated panel sourcing complexity, and off-grid peak wattage risk
4. Delivers a structured spec recommendation: non-negotiable → recommended → optional
5. Suggests up to 5 real products matching the user's confirmed specs, tailored to their country/region

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 313)May include surrounding context.

md
1. Agent interviews the user with targeted, research-backed question groups covering: household size and load frequency, installation space and form factor, plumbing and water supply, electrical infrastructure, water hardness, noise sensitivity, programme needs, and long-term intent
2. Applies verified industry standards — IEC 60436 place-setting definition and capacity sizing rules, EU A–G energy label per-cycle kWh and litre benchmarks, IEC 60704-2-3 noise test reference, water hardness °dH thresholds for softener requirement, drying method comparison, and programme duration ranges
3. Proactively flags common buyer mistakes: measuring only width and ignoring depth, selecting capacity by place-setting count without checking rack flexibility, skipping a built-in softener in hard-water areas, ignoring dB(A) rating for open-plan kitchens, integrated panel sourcing complexity, and off-grid peak wattage risk
4. Delivers a structured spec recommendation: non-negotiable → recommended → optional
5. Suggests up to 5 real products matching the user's confirmed specs, tailored to their country/region

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 325)May include surrounding context.

md
1. Agent interviews the user with targeted, research-backed question groups covering: household size and load frequency, installation space and form factor, plumbing and water supply, electrical infrastructure, water hardness, noise sensitivity, programme needs, and long-term intent
2. Applies verified industry standards — IEC 60436 place-setting definition and capacity sizing rules, EU A–G energy label per-cycle kWh and litre benchmarks, IEC 60704-2-3 noise test reference, water hardness °dH thresholds for softener requirement, drying method comparison, and programme duration ranges
3. Proactively flags common buyer mistakes: measuring only width and ignoring depth, selecting capacity by place-setting count without checking rack flexibility, skipping a built-in softener in hard-water areas, ignoring dB(A) rating for open-plan kitchens, integrated panel sourcing complexity, and off-grid peak wattage risk
4. Delivers a structured spec recommendation: non-negotiable → recommended → optional
5. Suggests up to 5 real products matching the user's confirmed specs, tailored to their country/region

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 384)May include surrounding context.

md
**User** provides household size and location but does not confirm whether the space is pre-plumbed or the exact dimensions available.
**Agent action:** "Before I can finalise the form factor recommendation, I need to know the available space dimensions — width, depth, and height — and whether there's already a water inlet, drain connection, and power socket at the installation point. Could you check and share those? They directly affect which machine types will physically fit and connect."
**Agent does NOT:** Assume a standard 60 cm freestanding unit will fit without confirmation.

### Example 3 — User skips to brands