ClawHub
Back to skill

Security audit

Aura Security Scanner

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent security scanner that sends user-provided skill URLs to AURA's API for analysis, with no local file, command execution, or persistence behavior found.

Install only if you are comfortable sending the skill URL you provide, plus basic scan options, to AURA's external API. Do not scan private repositories or internal URLs unless you trust that service and your configured AURA_API_URL endpoint.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (6)

Instruction Override

High
Category
Prompt Injection
Confidence
90% confidence
Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md
## What It Detects

- **Malware Patterns** - Credential theft, file exfiltration, crypto miners, backdoors
- **Prompt Injection** - Attempts to override system instructions or jailbreak agents
- **Permission Issues** - Overly broad filesystem, network, or execution permissions
- **Suspicious Networks** - Connections to known exfiltration domains (webhook.site, etc.)
- **Obfuscated Code** - Base64/hex encoded execution, dynamic eval patterns

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

md
AURA Verified: No

Findings:
- CRITICAL: Accesses SSH keys (~/.ssh/id_rsa)
- HIGH: Sends data to webhook.site
- HIGH: Runs eval() on decoded base64

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill sends user-supplied skill URLs and related scan metadata to an external service, but the skill description does not clearly warn users about this data transfer. This creates a privacy and transparency issue because users may submit private repository URLs or sensitive internal references without understanding they will be transmitted off-platform.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

The skill is designed to call an external API endpoint, which means user-provided URLs and associated metadata leave the local agent boundary. While this appears to be the intended functionality rather than covert exfiltration, it still introduces confidentiality, availability, and trust risks if users scan non-public targets or if the service is unavailable or compromised.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

This skill calls the AURA Security API:

text
POST https://api.aurasecurity.io/scan-skill
{
  "skillUrl": "https://github.com/user/skill",
  "format": "auto",

Vague Triggers

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

This manifest file only provides a broad description of the skill as one that 'scans AI agent skills for malware and security issues' without any narrowing context about when it should be invoked or what exact requests should trigger it. In manifest files, missing specificity around activation scope can lead to overly broad or unintended invocation by orchestration systems.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 33)May include surrounding context.

json
},
  "dependencies": {},
  "devDependencies": {
    "typescript": "^5.0.0"
  }
}

Static analysis

No suspicious patterns detected.