ClawHub
Back to skill

Security audit

project-planning

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a planning aid, but it automatically hands off to an execution skill without asking the user first.

Install only if you are comfortable with this planning skill automatically continuing into the execution phase after it creates `docs/implementation-plan.md`. To keep it planning-only, invoke it with `--standalone` or explicitly tell the agent to stop after planning.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:67
Finding

Mandatory Consent-Free Transition from Planning to Project Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 67–88
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Complete Code Snippet

md
## Post-Completion: Workflow Continuation (REQUIRED)

**Automatic Trigger**: After Quality Checks pass and `docs/implementation-plan.md` is saved, MUST auto-invoke the next phase.

**When continuation is invoked**:
1. Verify `docs/implementation-plan.md` exists and is non-empty
2. Display checkpoint message to user:

Implementation plan complete. Saved to docs/implementation-plan.md. Proceeding to execution phase...

text
3. Invoke next phase:

Skill(attune:project-execution)

text

**Bypass Conditions** (ONLY skip continuation if ANY true):
- `--standalone` flag was provided by the user
- `docs/implementation-plan.md` does not exist or is empty (phase failed)
- User explicitly requests to stop after planning

**Do NOT prompt the user for confirmation** — this is a lightweight checkpoint, not an interactive gate. The user can always interrupt if needed.

Technical Analysis

The skill describes itself as converting a completed specification into a phased implementation plan. However, the quoted instructions mandate invoking the separate attune:project-execution skill after the plan is created. They also explicitly prohibit asking for confirmation.

This alters the active objective from planning to execution and exceeds the authority reasonably implied by invoking a planning skill. Displaying a checkpoint message does not constitute consent because execution is initiated automatically after the message. The limited bypass conditions place the burden on users to anticipate and reject behavior that is not part of the skill's primary declared purpose.

The implementation of attune:project-execution was not present in the audited project, so its exact behavior cannot be verified. Nevertheless, the instruction-level redirection and suppression of consent ...[truncated 1311 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the mandatory automatic invocation of Skill(attune:project-execution).
  2. End the planning workflow after saving and reporting the implementation plan.
  3. If workflow continuation is offered, make it opt-in and request explicit, informed confirmation before invoking the execution skill.
  4. Explain the anticipated capabilities and effects of the execution phase before requesting consent.
  5. Treat silence or the absence of --standalone as non-consent rather than authorization.
  6. Add a strict phase boundary so planning cannot invoke tools or skills that modify project code, execute commands, deploy resources, or contact external services.
  7. Replace the problematic section with language such as:
md
After saving `docs/implementation-plan.md`, report completion and stop.
Optionally offer the execution phase, but invoke
`Skill(attune:project-execution)` only after the user explicitly approves it.
  1. Independently audit attune:project-execution before recommending or invoking it, especially for filesystem, shell, credential, network, and deployment capabilities.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill mandates automatic invocation of Skill(attune:project-execution) after writing the plan and explicitly suppresses a confirmation step. That creates an autonomy boundary violation: a planning-only skill can transition into an execution phase that may perform code changes or other side effects without an explicit user opt-in at the time of handoff.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
97% confidence
Finding

The instruction 'Do NOT prompt the user for confirmation' reinforces autonomous decision-making and prevents the user from approving a transition into a more powerful execution phase. In the context of an agent skill chain, this reduces human oversight precisely where scope and side effects can expand from documentation to execution.

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

md
- `docs/implementation-plan.md` does not exist or is empty (phase failed)
- User explicitly requests to stop after planning

**Do NOT prompt the user for confirmation** — this is a lightweight checkpoint, not an interactive gate. The user can always interrupt if needed.

## Related Skills