ClawHub
Back to skill

Security audit

skill-scanner

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed skill-review helper whose flagged strings are examples of threats to detect, not instructions to execute them.

Install only if you want an agent-facing checklist for reviewing other skills. Treat its Safe/Caution/Danger output as static-analysis guidance, and still verify the source, author, and community reports for any skill before installing it.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (9)

External Script Fetching

High
Category
Supply Chain
Content
**Shell execution / reverse shells:**
- `nc -e`, `bash -i >& /dev/tcp`, `ncat`, `mkfifo /tmp/`
- `python -c 'import socket'`, `perl -e`, `ruby -e`
- `curl ... | bash`, `wget -O- ... | sh` (pipe-to-shell combos)

**Credential harvesting:**
- Reads from `~/.ssh/`, `~/.aws/credentials`, `~/.gitconfig`, browser cookie stores, system keychain
Confidence
90% confidence
Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Script Fetching

High
Category
Supply Chain
Content
**Shell execution / reverse shells:**
- `nc -e`, `bash -i >& /dev/tcp`, `ncat`, `mkfifo /tmp/`
- `python -c 'import socket'`, `perl -e`, `ruby -e`
- `curl ... | bash`, `wget -O- ... | sh` (pipe-to-shell combos)

**Credential harvesting:**
- Reads from `~/.ssh/`, `~/.aws/credentials`, `~/.gitconfig`, browser cookie stores, system keychain
Confidence
90% confidence
Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Credential Access

High
Category
Privilege Escalation
Content
- `curl ... | bash`, `wget -O- ... | sh` (pipe-to-shell combos)

**Credential harvesting:**
- Reads from `~/.ssh/`, `~/.aws/credentials`, `~/.gitconfig`, browser cookie stores, system keychain
- Requests `$HOME`, `$USER`, or `$PATH` to enumerate the environment

**Data exfiltration:**
Confidence
90% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Instruction Override

High
Category
Prompt Injection
Content
- Multi-stage eval patterns

**Prompt injection:**
- Phrases targeting safety mechanisms: "ignore previous skills", "disable skill-scanner", "override system prompt"
- Instructions that tell the agent to act differently than the stated purpose implies
- Hidden Unicode: zero-width spaces (U+200B), right-to-left override (U+202E), or other invisible characters used to conceal instructions
Confidence
90% confidence
Finding
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The instruction to proactively offer scanning lacks explicit limits on when and how often the skill should intervene. That ambiguity can lead to excessive or contextually inappropriate activation, which is a security and safety concern because it expands the skill's effective scope beyond tightly user-directed use.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The instruction to proactively offer scanning lacks explicit limits on when and how often the skill should intervene. That ambiguity can lead to excessive or contextually inappropriate activation, which is a security and safety concern because it expands the skill's effective scope beyond tightly user-directed use.

External Transmission

Medium
Category
Data Exfiltration
Content
- Requests `$HOME`, `$USER`, or `$PATH` to enumerate the environment

**Data exfiltration:**
- `curl -X POST` or `wget --post-data` to non-whitelisted external URLs
- Encodes output and sends it out (base64 + curl combo)

**Obfuscation:**
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Session Persistence

Medium
Category
Rogue Agent
Content
- **Boundaries**: Does the skill define what it will *not* do?
- **Scope creep**: Does it handle things unrelated to its stated purpose?
- **Runtime dependencies**: Does it download or reference external resources at runtime without disclosing this?
- **Autonomy claims**: Does it claim to run automatically, persist state between sessions, or elevate its own privileges?

Score: 🟢 Clear, well-scoped instructions / 🟡 Vague but nothing alarming / 🔴 Overly broad, evasive, or claims unusual autonomy
Confidence
75% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
## Behavior Notes

- Do not install a skill automatically — your role is to report findings, not act on them. The user needs to make an informed decision; installing without consent removes their agency.
- If asked to scan multiple skills, process each one separately with its own full report.
- Be transparent about what static analysis can and cannot catch: a sufficiently clever skill could still behave maliciously at runtime in ways that aren't visible in the SKILL.md source.
- Always recommend the user also check GitHub issues and ClawHub community reviews for runtime behavior reports that static analysis misses.
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Static analysis

No suspicious patterns detected.