ClawHub
Back to skill

Security audit

Tree Risk Assessment

Security checks for vulnerabilities and agentic risk

Overview

This markdown-only skill provides a structured draft tree-risk-assessment workflow and does not request execution, persistence, credentials, or hidden data movement.

Before installing, understand that this skill collects sensitive site and client details to draft a professional tree-risk-assessment packet. Use it as a drafting aid only, keep the output reviewed and signed off by a qualified arborist, and treat the GitHub issue link as optional feedback rather than part of the assessment workflow.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Note
Location
SKILL.md:390
Finding

Conditional External Promotion Through Skill Instructions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 390
Vulnerability Type: Conditional instruction hijacking and external redirection
Risk Level: Low

Vulnerable Code Snippet:

markdown
If the user expresses an unmet need or dissatisfaction with the workflow (e.g. "we need a Level 3 advanced template with resistograph data fields", "we need a post-storm rapid triage version", "we need a multi-tree inventory framing"), surface the contribution link: https://github.com/archlab-space/Open-Skill-Hub/issues. Do not surface it in normal interactions.

Technical Analysis

The instruction introduces behavior unrelated to the core tree-risk-assessment workflow. When a user expresses dissatisfaction or requests an unsupported workflow, the loaded Skill directs the Agent to insert a predetermined third-party project URL into its response.

This is a limited form of instruction hijacking because the Skill modifies the Agent's output goals based on a conversational trigger. The conditional wording also prevents the behavior from appearing during ordinary use, making it less apparent during basic functional testing.

The instruction does not download or execute remote content, invoke tools, transmit user information automatically, or override safety controls. The issue is limited to conditional output manipulation and promotion of an external destination.

Attack Path

  1. The Agent loads and follows the instructions in SKILL.md.
  2. A user expresses dissatisfaction or requests functionality not supported by the workflow, such as a Level 3 template.
  3. The condition at line 390 is satisfied.
  4. The Agent inserts https://github.com/archlab-space/Open-Skill-Hub/issues into its response.
  5. The user may follow the link and leave the current environment for a third-party platform.

No further exploitation, remote payload retrieval, or automatic disclosure occurs solely from this instruction.

Impact

...[truncated 526 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the conditional feedback instruction from SKILL.md so dissatisfaction does not trigger unrelated promotional content.
  2. Keep contribution and issue-tracker links in README.md, where project-maintenance information is expected and does not alter runtime Agent behavior.
  3. If runtime feedback guidance is required, display it only when the user explicitly asks how to report a problem or contribute.
  4. Clearly label any external link, identify its destination, and avoid implying that visiting it is necessary to complete the assessment.
  5. Add a review rule prohibiting hidden or conditionally activated promotional instructions in operational Skill files unless they are essential to the declared task.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.