ClawHub
Back to skill

Security audit

skill-navigator

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed local dashboard scaffold that reads installed skill metadata, with no observed network, persistence, or destructive behavior.

Before installing, be aware that this is more of a scanner and Markdown dashboard template than a finished interactive dashboard. It will read SKILL.md metadata from installed skills under /home/ubuntu/skills and may present broad skill suggestions; review those suggestions before enabling any higher-privilege skill.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (9)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding
There is a clear description-behavior mismatch. The declared purpose promises substantial functionality around visualizing installed skills and their capabilities, but the actual code chunk does not implement any of that behavior. It is merely a placeholder script with a print statement and comments indicating future work. No undeclared sensitive capability is present, but the primary purpose of the code does not match the advertised functionality.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The code does inspect installed skills and derive a basic capability map, which partially relates to the declared goal. However, its actual behavior is limited to backend-style scanning of local skill metadata and emitting JSON. It does not implement a dashboard, visual overview, interactivity, or contextual prompting as claimed. The primary purpose in the description is user-facing visualization, while the code is only a data extraction script supporting that concept. This is a material description-behavior mismatch.

Ae1

High
Category
analysis-evasion
Content
**Mechanism**: Automatically extracts metadata (name, description) from `SKILL.md` files. Each skill is represented as a card with an icon, category tags, and
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
**Mechanism**: Automatically extracts metadata (name, description) from `SKILL.md` files. Each skill is represented as a card with an icon, category tags, and
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
**Mechanism**: Automatically extracts metadata (name, description) from `SKILL.md` files. Each skill is represented as a card with an icon, category tags, and
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill instructs the operator to run a local Python script that scans `/home/ubuntu/skills/`, which is a file-read capability, but it does not declare any tool scope or permissions. Missing tool declarations reduce transparency and policy enforcement, making it easier for a skill to access local files beyond what a reviewer or runtime expects.

Natural-Language Policy Violations

Medium
Confidence
93% confidence
Finding
The skill embeds Chinese-only labels such as "可视化看板", "能力矩阵", and "智能联想提示", and the example user-facing prompt at L24 is written only in Chinese. This indicates a language preference is being imposed on users without offering a choice or documenting a justified locale restriction.

Natural-Language Policy Violations

Medium
Confidence
91% confidence
Finding
The visible user-facing text throughout the template is Chinese, which implies a fixed language experience. There is no indication that users can choose another language or that the locale restriction is intentional and justified for a region-specific skill.

Vague Triggers

Medium
Confidence
96% confidence
Finding
The template defines very broad keyword-to-skill mappings such as '数据/报表', '设计/视频', and '代码/API' that could match many ordinary user requests and cause automatic or strongly implied skill activation without clear user intent. In a dashboard meant to influence skill selection, this can lead to over-triggering, unintended invocation of higher-privilege skills, or user confusion about why a capability was activated.

Static analysis

No suspicious patterns detected.