ClawHub
Back to skill

Security audit

token-conservation

Security checks for vulnerabilities and agentic risk

Overview

This skill is transparent and non-executable, but it broadly enforces session-wide workflow limits that can interfere with correct analysis or development work.

Install only if you intentionally want a strict token-budget workflow. Treat its read limits and checklist as optional guidance, and do not let it block security reviews, debugging, or other work that needs more context. Be cautious before using the suggested external delegation, because the skill does not define what data may be shared.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:16
Finding

Mandatory Session-Wide Workflow Hijacks Agent Behavior

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 16–26, 31–45, and 89–94
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Vulnerable Code

markdown
## When To Use
- Run at the start of every session and whenever prompt sizes or tool calls begin to spike.
- Mandatory before launching long-running analyses, wide diffs, or massive context loads.

## When NOT To Use

- Context-optimization already handles the scenario
- Simple queries with minimal context

## Required TodoWrite Items
1. `token-conservation:quota-check`
2. `token-conservation:context-plan`
3. `token-conservation:delegation-check`
4. `token-conservation:compression-review`
5. `token-conservation:logging`
markdown
## Step 2 – Context Plan (`context-plan`)
- **Set a discovery read budget BEFORE reading any files.** Count each `Read` call
  and each content-mode `Grep` as one read. Glob and files-with-matches Grep are free.
  - Implement from spec/requirements: **max 8 reads**
  - Bug fix at known location: **max 5 reads**
  - Refactor with known scope: **max 1 read per file being changed**
  - Open exploration: **max 15 reads**
- **Read order** (most valuable first): spec/requirements, files to modify,
  imports/interfaces, then stop and start writing.
- **When budget is spent**: ask the user if more context is needed. Do NOT
  self-authorize additional reads. Only explicit user approval overrides the budget.
- Prefer `Read` with `offset`/`limit` params or `Grep` tool over loading whole files.
  A `Read` targeting <50 lines counts as 0.5 reads. Avoid `cat`/`sed`/`awk` via Bash
  — Claude Code 2.1.21+ steers toward native file tools (Read, Edit, Write, Grep, Glob).
markdown
## Output Expectations
- A short explanation of token-saving steps, delegated tasks, and remaining runway.
- Concrete next-action list that keeps the conversation lean (e.g.):
  - "next tur
...[truncated 2870 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the requirement to run the workflow at the beginning of every session. Require explicit user invocation or a clearly scoped opt-in configuration.
  2. Replace mandatory TodoWrite entries with optional recommendations that cannot supersede the user's primary task.
  3. Remove hard-coded read limits and the prohibition on self-authorizing additional reads. Treat read counts as nonbinding estimates and permit additional inspection whenever required for correctness or security.
  4. Make context planning adaptive to repository size, task complexity, risk, and available tooling.
  5. Remove mandatory logging, response content, and /new or /compact reminders. Include such information only when requested or directly relevant.
  6. State explicitly that conservation guidance must never override system instructions, developer instructions, user objectives, safety requirements, or the evidence collection needed to produce a correct result.
  7. If external delegation is retained, require explicit user approval and disclose the destination and data scope before transmitting repository content.
  8. Add a narrow applicability statement such as: “This skill provides optional token-efficiency suggestions only and must not block or alter completion of the requested task.”

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill’s front-matter description instructs users to use it at the start of every session, which is overly broad activation guidance for a workflow that is only relevant in specific high-context or quota-sensitive situations. This can cause unnecessary invocation, add process overhead, and normalize indiscriminate skill use, increasing the chance that users follow rigid session procedures even when they do not fit the task.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The trigger condition 'whenever prompt sizes or tool calls begin to spike' is vague and subjective, leaving too much discretion about when the skill should activate. Ambiguous triggers can lead to overuse, inconsistent operator behavior, and unnecessary workflow interruptions, especially because the skill imposes mandatory checklist steps and budgeting constraints.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.