ClawHub
Back to skill

Security audit

sub-agents

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed sub-agent orchestration skill with powerful but purpose-aligned behavior and no hidden code, persistence, or exfiltration found.

Install only if you want your agent to spawn and manage sub-agents. Use explicit task scopes, prefer sandboxed children for sensitive work, avoid attaching secrets or untrusted documents as instructions, and monitor or kill spawned sessions when they are no longer needed.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
91% confidence
Finding

The skill explicitly instructs operators to place all needed instructions, constraints, domain knowledge, and output behavior into the sub-agent task because sub-agents are context-blind. This creates a prompt-injection and prompt-extraction risk: if untrusted content is included in the handoff or referenced files, the child agent may treat attacker-controlled text as authoritative instructions, potentially causing data exfiltration, unsafe actions, or suppression of visibility via announce control.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md
2. Whatever files you tell them to read (via paths in the task)
3. Inline `attachments` you pass at spawn time

**Everything the sub-agent needs must be in the task spec or explicitly referenced as a file path.** This includes output instructions, announce behavior, constraints, and domain knowledge.

## When to Spawn

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger description is broad enough to activate on many common requests involving delegation, research, analysis, or parallel work. In practice this can cause unnecessary invocation of a powerful orchestration skill, increasing the chance of unintended sub-agent spawning, tool misuse, or context leakage into child tasks when a simpler local response would have sufficed.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.