ClawHub
Back to skill

Security audit

Protein Supplement Buying Consultant

Security checks for vulnerabilities and agentic risk

Overview

This is an instruction-only protein supplement buying guide with health cautions and no hidden system access or persistence.

Before installing, understand that this skill may influence supplement purchases and discusses health-related constraints. Users with medical conditions, pregnancy/breastfeeding concerns, or questions for children should follow the skill's own guidance to consult a qualified healthcare professional.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
1. Using collagen as a substitute for complete protein for muscle building — collagen lacks tryptophan and has negligible leucine; it does not support muscle protein synthesis and should not count toward the muscle-building protein target
2. Buying whey concentrate with lactose intolerance — concentrate retains more lactose than isolate; causes digestive distress; whey isolate or hydrolysate are appropriate alternatives
3. Buying single-source plant protein without checking amino acid completeness — rice alone is low in lysine; pea alone is low in methionine; a blended pea+rice product is needed
4. Not verifying third-party certification — protein powders are not FDA-regulated for accuracy or purity; Clean Label Project (2025) found 70% of tested powders contained measurable lead, 74% contained cadmium; plant-based powders tested positive for lead at 77% and contained 3× more lead than whey products; a third-party certification seal is the only consumer-accessible verification
5. Falling for nitrogen spiking — glycine, taurine, and creatine can inflate nitrogen readings, making a product appear to contain more protein than it does; a published certificate of analysis (COA) from an independent lab is the only reliable check; NSF and Informed Sport certifications include amino acid verification
6. Choosing by protein per serving without checking scoop weight — a 40 g scoop with 25 g protein is lower quality (63% protein) than a 30 g scoop with 25 g protein (83% protein); smaller, denser scoops indicate fewer fillers
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
1. Using collagen as a substitute for complete protein for muscle building — collagen lacks tryptophan and has negligible leucine; it does not support muscle protein synthesis and should not count toward the muscle-building protein target
2. Buying whey concentrate with lactose intolerance — concentrate retains more lactose than isolate; causes digestive distress; whey isolate or hydrolysate are appropriate alternatives
3. Buying single-source plant protein without checking amino acid completeness — rice alone is low in lysine; pea alone is low in methionine; a blended pea+rice product is needed
4. Not verifying third-party certification — protein powders are not FDA-regulated for accuracy or purity; Clean Label Project (2025) found 70% of tested powders contained measurable lead, 74% contained cadmium; plant-based powders tested positive for lead at 77% and contained 3× more lead than whey products; a third-party certification seal is the only consumer-accessible verification
5. Falling for nitrogen spiking — glycine, taurine, and creatine can inflate nitrogen readings, making a product appear to contain more protein than it does; a published certificate of analysis (COA) from an independent lab is the only reliable check; NSF and Informed Sport certifications include amino acid verification
6. Choosing by protein per serving without checking scoop weight — a 40 g scoop with 25 g protein is lower quality (63% protein) than a 30 g scoop with 25 g protein (83% protein); smaller, denser scoops indicate fewer fillers
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Static analysis

No suspicious patterns detected.