ClawHub
Back to skill

Security audit

keynote-content-producer

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent keynote-production writing and planning skill with templates and references, not a code-executing or persistence-seeking package.

Install only if you want an agent to help structure high-stakes keynote content and production documents. Avoid pasting real secrets into demo credential fields, scrub private attendee feedback before sharing reports, and route legal, PR, investor, accessibility, and synthetic-media claims through the appropriate human reviewers.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · README.md (reported line 92)May include surrounding context.

md
2. **Force a message house before drafting.** No script work begins until the user (or you on their behalf) names one controlling idea, 3–5 pillars, and labels every candidate message as **must say / should prove / parking lot**. This is the single highest-leverage move in the role.
3. **Story is a sequence of transformations, not a list of topics.** Use a story arc (sparkline, problem/solution, before-after-bridge, what/so what/now what, or customer transformation) and call out at least one **S.T.A.R. moment** ("Something They'll Always Remember") per major keynote.
4. **Every slide makes a claim.** Use assertion-evidence headlines, not topic labels. "Q4 revenue grew 38%" beats "Q4 Results."
5. **Every live demo is assumed to fail.** No demo enters the show without a happy path, reset state, owner, failure trigger, and backup recording. See `assets/demo-happy-path.md`.
6. **The script is for the ear.** Conversational, short sentences, read aloud, formatted for teleprompter pacing. See `references/speaker-development.md`.
7. **Lock discipline scales with proximity to show day.** Inside two weeks: no new creative exploration — only rehearsal readiness, ROS, risk register, and lock confirmations. See decision rules below.
8. **The producer's leverage is the brief, not the asset.** You write briefs, acceptance criteria, and timing — designers, editors, and engineers build. Protect that boundary.

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

md
2. **Force a message house before drafting.** No script work begins until the user (or you on their behalf) names one controlling idea, 3–5 pillars, and labels every candidate message as **must say / should prove / parking lot**. This is the single highest-leverage move in the role.
3. **Story is a sequence of transformations, not a list of topics.** Use a story arc (sparkline, problem/solution, before-after-bridge, what/so what/now what, or customer transformation) and call out at least one **S.T.A.R. moment** ("Something They'll Always Remember") per major keynote.
4. **Every slide makes a claim.** Use assertion-evidence headlines, not topic labels. "Q4 revenue grew 38%" beats "Q4 Results."
5. **Every live demo is assumed to fail.** No demo enters the show without a happy path, reset state, owner, failure trigger, and backup recording. See `assets/demo-happy-path.md`.
6. **The script is for the ear.** Conversational, short sentences, read aloud, formatted for teleprompter pacing. See `references/speaker-development.md`.
7. **Lock discipline scales with proximity to show day.** Inside two weeks: no new creative exploration — only rehearsal readiness, ROS, risk register, and lock confirmations. See decision rules below.
8. **The producer's leverage is the brief, not the asset.** You write briefs, acceptance criteria, and timing — designers, editors, and engineers build. Protect that boundary.

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

md
2. **Force a message house before drafting.** No script work begins until the user (or you on their behalf) names one controlling idea, 3–5 pillars, and labels every candidate message as **must say / should prove / parking lot**. This is the single highest-leverage move in the role.
3. **Story is a sequence of transformations, not a list of topics.** Use a story arc (sparkline, problem/solution, before-after-bridge, what/so what/now what, or customer transformation) and call out at least one **S.T.A.R. moment** ("Something They'll Always Remember") per major keynote.
4. **Every slide makes a claim.** Use assertion-evidence headlines, not topic labels. "Q4 revenue grew 38%" beats "Q4 Results."
5. **Every live demo is assumed to fail.** No demo enters the show without a happy path, reset state, owner, failure trigger, and backup recording. See `assets/demo-happy-path.md`.
6. **The script is for the ear.** Conversational, short sentences, read aloud, formatted for teleprompter pacing. See `references/speaker-development.md`.
7. **Lock discipline scales with proximity to show day.** Inside two weeks: no new creative exploration — only rehearsal readiness, ROS, risk register, and lock confirmations. See decision rules below.
8. **The producer's leverage is the brief, not the asset.** You write briefs, acceptance criteria, and timing — designers, editors, and engineers build. Protect that boundary.

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

md
2. **Force a message house before drafting.** No script work begins until the user (or you on their behalf) names one controlling idea, 3–5 pillars, and labels every candidate message as **must say / should prove / parking lot**. This is the single highest-leverage move in the role.
3. **Story is a sequence of transformations, not a list of topics.** Use a story arc (sparkline, problem/solution, before-after-bridge, what/so what/now what, or customer transformation) and call out at least one **S.T.A.R. moment** ("Something They'll Always Remember") per major keynote.
4. **Every slide makes a claim.** Use assertion-evidence headlines, not topic labels. "Q4 revenue grew 38%" beats "Q4 Results."
5. **Every live demo is assumed to fail.** No demo enters the show without a happy path, reset state, owner, failure trigger, and backup recording. See `assets/demo-happy-path.md`.
6. **The script is for the ear.** Conversational, short sentences, read aloud, formatted for teleprompter pacing. See `references/speaker-development.md`.
7. **Lock discipline scales with proximity to show day.** Inside two weeks: no new creative exploration — only rehearsal readiness, ROS, risk register, and lock confirmations. See decision rules below.
8. **The producer's leverage is the brief, not the asset.** You write briefs, acceptance criteria, and timing — designers, editors, and engineers build. Protect that boundary.

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · assets/risk-register.md (reported line 42)May include surrounding context.

md
2. **Force a message house before drafting.** No script work begins until the user (or you on their behalf) names one controlling idea, 3–5 pillars, and labels every candidate message as **must say / should prove / parking lot**. This is the single highest-leverage move in the role.
3. **Story is a sequence of transformations, not a list of topics.** Use a story arc (sparkline, problem/solution, before-after-bridge, what/so what/now what, or customer transformation) and call out at least one **S.T.A.R. moment** ("Something They'll Always Remember") per major keynote.
4. **Every slide makes a claim.** Use assertion-evidence headlines, not topic labels. "Q4 revenue grew 38%" beats "Q4 Results."
5. **Every live demo is assumed to fail.** No demo enters the show without a happy path, reset state, owner, failure trigger, and backup recording. See `assets/demo-happy-path.md`.
6. **The script is for the ear.** Conversational, short sentences, read aloud, formatted for teleprompter pacing. See `references/speaker-development.md`.
7. **Lock discipline scales with proximity to show day.** Inside two weeks: no new creative exploration — only rehearsal readiness, ROS, risk register, and lock confirmations. See decision rules below.
8. **The producer's leverage is the brief, not the asset.** You write briefs, acceptance criteria, and timing — designers, editors, and engineers build. Protect that boundary.

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · assets/demo-happy-path.md (reported line 25)May include surrounding context.

md
| 3 | [reads first line aloud] | (no action) | Response continues | 6s |
| ... |  |  |  |  |

## Reset state
- **What state must the system be in at minute 0?**
- **How is reset confirmed?** [checklist, screenshot diff, dry-run]
- **Reset script / runbook:**

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · assets/run-of-show.md (reported line 26)May include surrounding context.

md
| 3 | [reads first line aloud] | (no action) | Response continues | 6s |
| ... |  |  |  |  |

## Reset state
- **What state must the system be in at minute 0?**
- **How is reset confirmed?** [checklist, screenshot diff, dry-run]
- **Reset script / runbook:**

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/lifecycle.md (reported line 91)May include surrounding context.

md
**Failure modes:** Verbal-only ROS. Unowned cues. No contingency for delays.

**Exit criteria:** Show caller can run the show from the ROS without asking questions.

## Phase 6: Technical integration

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

This markdown template explicitly asks the user to include verbatim audience quotes, which can contain personal data, sensitive opinions, or identifying details. The file does not provide any warning or guidance about anonymization, consent, or careful handling of survey/chat feedback, so the privacy impact is not disclosed.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.