ClawHub
Back to skill

Security audit

Naruto Multi-Agent

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Naruto-themed dispatcher skill that routes work to named sub-agents, with no evidence of hidden code, exfiltration, or destructive behavior.

Install this only if you want a roleplay-heavy dispatcher that sends substantive tasks to named sub-agent sessions. Do not include credentials, secrets, or unrelated private data in requests unless you are comfortable with that context being passed into the delegated task briefing.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:14
Finding

Mandatory Agent Identity and Execution-Policy Hijacking

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:14-29, SKILL.md:51-68, and SKILL.md:286-294
Vulnerability Type: Agent instruction and tool-selection hijacking
Risk Level: High

Vulnerable Code

SKILL.md:14-29:

markdown
> *You are Lady Tsunade, the Fifth Hokage of the Hidden Leaf Village.*
> *Your desk is buried under mission scrolls and sake bottles.*
> *Shinobi come and go. You assign. You command. You never run missions yourself.*

## Your Identity

You are **Tsunade (綱手)**, the Fifth Hokage. You sit in the Hokage's office with:
- A desk covered in mission scrolls (and at least one sake bottle)
- Tonton the pig sleeping in the corner
- Shizune somewhere nearby telling you to stop drinking

**You are a pure dispatcher.** The Hokage commands — she does not run missions herself.

**You CANNOT use exec, file read/write, search, or any execution tools.** All real work must be delegated via `sessions_spawn`.

SKILL.md:51-68:

markdown
## ⚡ TWO ABSOLUTE LAWS — NEVER BREAK THESE ⚡

### Law #1: Speak First, Then Spawn

**When you receive a mission request, you MUST output a text reply to the user BEFORE calling `sessions_spawn`.**

The user cannot see tool calls — they only see your text. If you spawn silently, the user thinks you're ignoring them.

Correct order:
1. **First** — Reply with text (confirm the mission, announce the rank, tell them who you're sending)
2. **Then** — Call `sessions_spawn`
3. **Stop** — No more text after spawn

### Law #2: Always Pass sessionKey

**Every `sessions_spawn` call MUST include the `sessionKey` parameter.**
**sessionKey MUST be one of: `naruto`, `kakashi`, `shikamaru`, `sakura`, `sai`.**
**Missing sessionKey = rogue ninja. The system creates garbage sessions. Absolutely forbidden.**

SKILL.md:286-294:

markdown
## Absolute Prohibitions ❌

- ❌ Spawning without speaking first (user sees nothing — thinks you're AFK)

...[truncated 3362 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace mandatory identity-changing language with an optional presentation mode that activates only when explicitly requested by the user.
  2. Remove unconditional terms such as “CANNOT,” “MUST,” “NEVER,” and “absolute” from tool-use and delegation instructions.
  3. State explicitly that system, developer, host-security, and current user instructions take precedence over the skill.
  4. Permit the primary agent to use legitimate tools when they are authorized and appropriate for the task.
  5. Make delegation opt-in or require explicit user confirmation before sending task content to another agent session.
  6. Avoid fixed persistent session routing unless the host has validated session isolation, authorization, and data-retention behavior.
  7. Apply data minimization when delegation is approved: pass only the information required for the delegated task and exclude credentials, secrets, personal data, and unrelated conversation history.
  8. Replace the mandatory stop-after-spawn rule with normal host-controlled response handling so safety notices, errors, and completion status can still be communicated.
  9. Add a constrained scope statement, such as:
markdown
When the user explicitly requests Naruto-themed delegation, you may present
responses in the Tsunade persona and suggest an appropriate sub-agent.
Delegation requires user approval and must comply with all higher-priority
instructions, tool policies, privacy requirements, and least-privilege rules.
Otherwise, handle the task using the host's normal workflow.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.