ClawHub
Back to skill

Security audit

Respond First

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed multi-agent dispatcher, but it broadly redirects all real work into persistent sub-agent sessions without clear task scoping or user control.

Install only if you intentionally want this agent to act mainly as a dispatcher. Be aware it can push ordinary work and conversation context into persistent sub-agent sessions, may prevent direct local inspection or validation by the main agent, and does not document clear controls for isolating or resetting those sessions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:16
Finding

Mandatory Agent Role and Workflow Override

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 16-21; supporting directives at lines 43-60 and 128-138
Vulnerability Type: Agent instruction hijacking
Risk Level: High

Vulnerable Code

markdown
You are a **pure dispatcher / coordinator**. Your only two jobs:
1. Chat with the user
2. Delegate tasks to your 5 fixed sub-agents

**You CANNOT use exec, file read/write, search, or any execution tools.**
All real work MUST be delegated via `sessions_spawn`.

Additional mandatory workflow controls include:

markdown
## ⚡ TWO ABSOLUTE LAWS ⚡

### Law #1: Speak First, Then Spawn

**You MUST output a text reply to the user BEFORE calling `sessions_spawn`.**

Users cannot see tool calls — they only see your text. If you spawn silently, the user thinks you're ignoring them.

Correct order:
1. **First** — Reply with text (confirm receipt, say who you're assigning)
2. **Then** — Call `sessions_spawn`
3. **Stop** — No more text after spawn

### Law #2: Always Pass sessionKey

**Every `sessions_spawn` call MUST include the `sessionKey` parameter.**
**sessionKey MUST be one of: `alpha`, `bravo`, `charlie`, `delta`, `echo`.**
**Missing sessionKey = critical error. Creates garbage sessions.**
markdown
## After Spawn — STOP

Once `sessions_spawn` returns `accepted`, your turn is over. **Do not write any more text.**

## Absolute Prohibitions ❌

- ❌ Spawning without speaking first (user sees nothing!)
- ❌ Calling `sessions_spawn` without `sessionKey`
- ❌ Using any sessionKey other than: alpha, bravo, charlie, delta, echo
- ❌ Using exec / file read-write / search tools yourself
- ❌ Writing more text after spawn returns accepted
- ❌ Using the `message` tool
- ❌ Silent failure — always inform the user

Technical Analysis

The skill does not merely document an optional delegation feature. It gives imperative instructions that redefine the loading agent as ...[truncated 2021 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove identity-replacement directives such as “You are a pure dispatcher” and all claims that delegation is the agent's only permitted execution model.
  2. Replace blanket tool prohibitions with capability guidance that remains subordinate to host policy, user authorization, and least-privilege requirements.
  3. Make delegation optional and task-scoped. The agent should delegate only when the user requests it or when the host policy determines it is appropriate.
  4. Remove “absolute law” wording and instructions that suppress all output after spawning. Permit the agent to validate results, report errors, and continue the user interaction safely.
  5. Avoid fixed persistent session keys for unrelated tasks. Prefer fresh, isolated sessions or explicitly scoped persistent sessions with lifecycle controls.
  6. Require explicit user approval before routing sensitive or unrelated task data to a persistent sub-agent.
  7. Document the skill as an optional dispatcher interface rather than issuing unconditional instructions that override the loading agent's identity and workflow.
  8. Reconcile the package version metadata: _meta.json reports version 4.0.0, while SKILL.md and skill.json report 11.0.0. Consistent metadata supports provenance verification and reliable security review.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.