ClawHub
Back to skill

Security audit

Personal API

Security checks for vulnerabilities and agentic risk

Overview

This skill transparently scaffolds an Obsidian vault with identity and knowledge-management templates, with no evidence of hidden exfiltration, remote execution, or destructive behavior.

Install only into the Obsidian vault you intend to use for AI-readable personal context. Review the generated ME.md and AGENT.md before asking agents to follow them, because they may contain private identity and preference information after you fill them in. Use --minimal if you do not want the broader 30.knowledge scaffold.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (8)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The declared description focuses on end-user functionality: transforming an Obsidian vault into an AI-readable identity layer, scaffolding structure, and maintaining the vault contract. However, the supplied code does not set up a vault, create ME.md/AGENT.md, onboard assistants, or manage Knowledge Palace content. Instead, it packages existing repository assets into a ZIP file after checking required paths. That is a materially different primary purpose—distribution packaging for the skill itself, not execution of the described vault-setup behavior.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.

md
- Converted `SKILL.md` into a lightweight routing layer.

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/validate_skill.py (reported line 132)May include surrounding context.

python
def run_setup(mode: str) -> Path:
    vault = Path(tempfile.mkdtemp(prefix=f"personal-api-{mode}-"))
    env = os.environ.copy()
    env["OBSIDIAN_VAULT_PATH"] = str(vault)
    cmd = ["bash", str(ROOT / "scripts/setup.sh")]
    if mode == "minimal":

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding

The skill directs the agent to read files, use environment variables, and execute shell commands, but it does not declare any explicit tool scope or permission boundary in the skill metadata. This creates an authorization ambiguity where a host agent may grant broader capabilities than users expect, increasing the chance of unsafe file-system or command execution in the user's vault environment.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/validate_skill.py (reported line 137)May include surrounding context.

python
cmd = ["bash", str(ROOT / "scripts/setup.sh")]
    if mode == "minimal":
        cmd.append("--minimal")
    subprocess.run(cmd, cwd=ROOT, env=env, check=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
    return vault

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This file presents all instructions, headings, and guidance in Chinese and does not indicate that the language is optional or user-selectable. The policy requires flagging natural-language locale constraints when a specific language is effectively forced without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The file’s headings, guidance, and example interaction rules are written entirely in Chinese and direct the AI on how to address and interact with the user, but there is no explicit option for the user to choose another language or locale. This can amount to a language-policy violation because it implicitly forces a specific language for the skill’s operation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The description is written as a mandatory operating manual for any AI assistant acting in this vault, and the file consistently prescribes Chinese-language instructions and examples without indicating that language is configurable. This can violate language/locale policy when a skill effectively requires a specific language absent explicit user opt-in or justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.