ClawHub
Back to skill

Security audit

Haccp Plan Drafter

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only food-safety plan drafting skill with clear review limits and no executable or persistent behavior.

Before installing, treat outputs as drafting assistance only: a qualified PCQI or HACCP team should validate all hazards, critical limits, citations, monitoring procedures, and corrective actions before operational or audit use.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Harmful Content Injection

Critical
Category
Prompt Injection
Confidence
70% confidence
Finding

This content may contain harmful instructions that could cause physical harm if followed. CRITICAL: Review carefully before use.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

md
### 4. Hazard analysis (Principle 1)

Use the Codex / NACMCF style. For each process step, work the user through:

1. Biological hazards reasonably foreseeable (e.g., Salmonella, Listeria monocytogenes, E. coli O157:H7 / STEC, C. botulinum, Cronobacter, norovirus, parasites).
2. Chemical hazards reasonably foreseeable (mycotoxins, heavy metals, pesticide residues, undeclared allergens, food-additive overages, processing-aid residues, radionuclides, sanitizer residues).
3. Physical hazards reasonably foreseeable (metal, glass, hard plastic, wood, stones, bone).
4. **Radiological** hazards if applicable.

For each candidate hazard, capture: