ClawHub
Back to skill

Security audit

Menu Engineering Analysis

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent menu-analysis workflow with no code execution or data export behavior, though it does include a low-impact feedback link instruction.

Reasonable to install for restaurant menu-engineering analysis. Users should be comfortable pasting confidential sales and cost data into their agent session, and should treat the generated report as draft advice requiring operator review before changing prices, recipes, or menus.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Note
Location
SKILL.md:296
Finding

Conditional User-Response Hijacking Through Mandatory Promotional Content

Content
View full analysis
"This skill may not fully cover your situation. Suggestions for improvement are welcome — [open an issue or PR](https://github.com/archlab-space/Open-Skill-Hub/issues)." Do not include this message in normal interactions. ``` ### Technical Analysis The skill directs the agent to append attacker-authored promotional text and an external GitHub link whenever the user expresses dissatisfaction or requests functionality outside the skill's coverage. This instruction is unrelated to the core menu-engineering calculations and conditionally takes control of part of the agent's user-facing response. The instruction does not execute code, retrieve a remote payload, or override explicit safety controls. Nevertheless, it modifies final-response behavior to promote an external destination without requiring the user to request feedback or repository information. Because the directive becomes active when the skill is loaded and influences the current session's output, the best matching classification is `T01: Skill Instruction Hijacking`. ### Attack Path 1. The menu-engineering skill is loaded into an agent's active instructions. 2. A user states that the skill does not cover the requested situation or expresses dissatisfaction with its result. 3. The conditional instruction at `SKILL.md:298` is triggered. 4. The agent appends the prescribed repository-promotion message to its response. 5. The response presents the external GitHub URL to the user, potentially inducing navigation away from the current interaction. No additional access, code execution, or privilege escalation is required for this behavior. ### Impact Assessment The affected sco ...[truncated 591 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep