ClawHub
Back to skill

Security audit

risk-classification

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed risk-classification guide, but its fail-open defaults could let unclassified or misclassified high-impact work proceed with too little verification.

Use this skill only as advisory guidance unless your orchestrator independently enforces mandatory classification, validates risk_tier values, and treats missing or uncertain classification conservatively. Do not rely on its default GREEN behavior for security, data, production, or irreversible changes.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:94
Finding

Missing Risk Metadata Defaults to GREEN and Bypasses Verification

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:94 and modules/verification-gates.md:13-18
Vulnerability Type: Fail-open security classification
Risk Level: High

Vulnerable Code

SKILL.md:94:

markdown
Tasks without `risk_tier` metadata default to **GREEN** (backward compatible).

modules/verification-gates.md:13-18:

markdown
### GREEN — No Gates

No verification required. Agent completes task and marks as done.

Task complete → Mark completed

Technical Analysis

The Skill uses a fail-open policy when the risk_tier field is missing. An unclassified task is automatically assigned GREEN, while GREEN tasks require no verification. This combines an untrusted or absent metadata value with the least restrictive execution path.

Missing metadata can result from an incompatible task generator, malformed input, accidental omission, or intentional manipulation. Because classification is not mandatory before task execution, the system cannot distinguish a genuinely low-risk task from a destructive or security-sensitive task whose metadata was omitted.

Attack Path

  1. An attacker or faulty integration creates a task involving a sensitive operation, such as modifying authentication logic or deleting production data.
  2. The task is submitted without a risk_tier metadata field.
  3. The Skill applies the documented default and classifies the task as GREEN.
  4. The GREEN verification policy permits immediate completion without tests, code review, reversibility scoring, or human approval.
  5. The sensitive change proceeds without the controls normally required for RED or CRITICAL tasks.

Impact Assessment

Exploitation does not directly grant additional operating-system privileges. It bypasses the Skill's procedural security controls within the agent's existing permissions. The resulting scope is therefore equal to the files, repositories, deployment systems, and data already ...[truncated 258 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace the GREEN default with a fail-closed policy.
  • Reject tasks whose risk_tier is missing, malformed, or outside the permitted enumeration.
  • Require the classifier to run successfully before any task can be assigned or executed.
  • If classification cannot be completed, default to RED and require manual assessment rather than defaulting to GREEN.
  • Record the classifier version, classification evidence, and affected files in task metadata.
  • Ensure downstream orchestrators independently enforce mandatory classification instead of trusting caller-supplied metadata.
  • Add negative tests covering omitted, empty, misspelled, and attacker-controlled risk_tier values.

T09 · Insecure Skill Coding Practices

Error
Location
modules/heuristic-classifier.md:101
Finding

Path-Only Classification Cannot Detect Documented Content-Sensitive Risks

Content
View full analysis

Vulnerability Details

File Location: modules/heuristic-classifier.md:14-25, modules/heuristic-classifier.md:101-109, and modules/tier-definitions.md:103-106
Vulnerability Type: Incomplete risk analysis and classification bypass
Risk Level: High

Vulnerable Code

modules/heuristic-classifier.md:14-25:

markdown
### CRITICAL Patterns

migrations/*delete*        # Destructive migration
migrations/*drop*          # Table/column drops
*.sql DROP                 # Raw SQL drops
*.sql TRUNCATE             # Data truncation
security/credentials*      # Credential management
**/secrets*                # Secret files
deploy/production*         # Production deployment
infrastructure/prod*       # Production infrastructure
**/data-deletion*          # Data deletion scripts

modules/heuristic-classifier.md:101-109:

text
for file in task.affected_files:
    pattern_tier = match_patterns(file.path)
    tier = max(tier, pattern_tier)

# Apply change type multiplier (escalate by 1 tier, capped at CRITICAL)
if any(file.change_type == DELETE for file in task.affected_files):
    TIERS = [GREEN, YELLOW, RED, CRITICAL]
    tier = TIERS[min(TIERS.index(tier) + 1, len(TIERS) - 1)]

modules/tier-definitions.md:103-106:

markdown
The classifier automatically escalates when:
- File count exceeds module boundary (YELLOW → RED)
- Security-sensitive imports detected in any file (→ RED minimum)
- Destructive operations detected in any file (→ CRITICAL)
- Task modifies files across 3+ top-level directories (→ RED minimum)

Technical Analysis

The documented classifier passes only file.path to match_patterns. It therefore lacks the file contents, change diff, parsed syntax, and imported symbols needed to identify operations such as SQL DROP, SQL TRUNCATE, security-sensitive imports, or destructive API calls.

Some listed patterns mix a filename glob with ...[truncated 1656 chars]

Remediation
View remediation

Remediation Suggestions

  • Extend classification inputs to include the complete change diff, file contents, operation type, and relevant task context.
  • Separate pathname rules from content rules instead of expressing both in a single ambiguous pattern.
  • Parse SQL and supported programming languages where practical, and detect destructive statements, credential handling, authorization changes, and sensitive imports.
  • Treat analysis failures, unsupported file formats, generated content, and ambiguous matches conservatively.
  • Assign at least RED to tasks containing security-sensitive operations and CRITICAL to confirmed destructive or irreversible operations.
  • Make all automatic escalation claims executable and testable, or remove claims that are not implemented.
  • Add regression tests using destructive logic in benign filenames, mixed-case SQL statements, dynamically constructed operations, renamed files, and files outside conventional security directories.
  • Require human review when content inspection cannot establish that a potentially sensitive change is safe.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger list contains very broad single-word activators such as "risk", "classification", "safety", and "verification", which are likely to appear in ordinary user conversations. In agent systems that auto-load or prioritize skills by trigger matching, this can cause unintended invocation of this skill, altering routing and decision-making in contexts where the user did not actually request risk classification.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · modules/verification-gates.md (reported line 15)May include surrounding context.

GREEN — No Gates

No verification required. Agent completes task and marks as done.

text
Task complete → Mark completed

Static analysis

No suspicious patterns detected.