ClawHub
Back to skill

Security audit

brief-yourself

Security checks for vulnerabilities and agentic risk

Overview

This skill manages a local, user-approved personal context store and its sensitive operations are disclosed, scoped, and gated by consent or approval steps.

Install only if you want a local personal-profile/context workflow. Review where the Store, Views, Patches, and exports will be written, and use private/restricted export, patch apply, migration, or purge commands only after checking the specific files and approvals.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
82% confidence
Finding
The skill declares no permissions, yet its documented runtime commands clearly enable file reads and writes across local stores, views, patches, exports, and purge operations. This creates a capability-transparency gap: users or orchestrators may treat the skill as low-privilege while it can modify sensitive local data, increasing the chance of unintended data access or destructive actions.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding
The top-level description frames the skill as an interview/calibration tool, but the body exposes extensive stateful filesystem operations including initialization, migration, export, patch application, and irreversible purge. This mismatch can mislead users and calling agents about the true authority of the skill, making social engineering, accidental destructive use, or overbroad invocation more likely in a context handling personal data.

Static analysis

No suspicious patterns detected.