ClawHub
Back to skill

Security audit

Workflows

Security checks for vulnerabilities and agentic risk

Overview

This skill is a documentation playbook for Gina workflow automation; its powerful workflow capabilities are disclosed and fit the stated purpose.

Before installing or using it, review each workflow definition you create or run, especially any Bash/exec, filesystem, KV, host-tool, external-posting, or trading steps. Keep permissions narrow, avoid raw secrets in definitions or logs, validate before running, and use baseline/rollback for risky changes.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Memory Manipulation

High
Category
Memory Poisoning
Content
- Setup path that a reviewer can execute in under 10 minutes.
- One reproducible run artifact or run log example.
- Clear statement of expected outputs and acceptable failure behavior.

## Optional Directories
Confidence
80% confidence
Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Ae1

High
Category
analysis-evasion
Content
- `references/cli-and-definition.md`
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Missing User Warnings

Medium
Confidence
89% confidence
Finding
This markdown file documents step types and runtime APIs that include shell execution (`exec`, `type: "bash"`), filesystem access (`fs.promises.*`), and key-value write/delete operations (`kv.set`, `kv.delete`). Under the markdown-specific warning criterion, the description should warn users that workflows may modify files, execute commands, or change persisted data, but no such warning appears here.

Static analysis

No suspicious patterns detected.