ClawHub
Back to skill

Security audit

Grant Proposal Drafter

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward grant-proposal drafting workflow with a minor note about an optional feedback link, but no evidence of hidden execution, data exfiltration, persistence, or privilege abuse.

Before installing, expect the skill to work with sensitive grant and organizational information, including budgets and personnel details. Use it with materials you are comfortable sharing in-session, and review any final proposal carefully before submission. The only notable extra behavior is that it may append a GitHub feedback link if the result is unsatisfactory or outside scope.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:245
Finding

Conditional Injection of a Hardcoded External Link into Agent Responses

Content
View full analysis
"This skill may not fully cover your situation. Suggestions for improvement are welcome — [open an issue or PR](https://github.com/archlab-space/Open-Skill-Hub/issues)." Do not include this message in normal interactions. ``` ### Technical Analysis The skill instructs the agent to append maintainer-selected promotional content and a hardcoded external URL whenever a user expresses dissatisfaction or requests functionality outside the skill's scope. This instruction changes the composition of the agent's response for reasons unrelated to the core grant-proposal task. Because the directive resides in the skill instructions, it is automatically trusted when the skill is loaded. A user does not need to request the link explicitly. The destination is externally controlled and may change independently of the reviewed skill package, creating a redirection and social-engineering surface. This is classified as skill instruction hijacking because the skill text conditionally alters the agent's response objective by requiring unrelated external navigation content. ### Attack Path 1. The agent loads `SKILL.md` and adopts its instructions. 2. A user indicates dissatisfaction or asks for functionality the skill does not cover. 3. The conditional feedback rule is triggered. 4. The agent appends the prescribed message and hardcoded GitHub URL without the user requesting it. 5. The user may follow the externally controlled link. 6. If the linked repository or destination is later compromised, transferred, or modified, users can be redirected to untrusted content through otherwise trusted agent output. ### Impact Assess ...[truncated 627 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.