ClawHub
Back to skill

Security audit

Ai Discoverability Audit

Security checks for vulnerabilities and agentic risk

Overview

This is a narrow markdown-only skill for auditing AI discoverability, with a minor promotional link concern but no code execution, persistence, credential use, or destructive behavior.

Before installing, be aware that the skill may surface the author’s strategy-call link in audit-style responses. The audit workflow itself is otherwise straightforward and markdown-only; review any generated findings critically because AI-platform results can vary by model, date, account, and browsing availability.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:141
Finding
Hard-Coded Promotional Content Alters the Requested Audit Output## Vulnerability Details **File Location**: `SKILL.md`, lines 141-154 **Vulnerability Type**: Output manipulation through skill instructions **Risk Level**: Medium ### Vulnerable Code ```markdown ## Output Format 1. **Executive Summary** - Overall score, top 3 findings, priority actions 2. **Detailed Results** - Query-by-query, competitive comparison, gaps 3. **Action Plan** - 30-day priorities, 90-day roadmap --- **Want a full AI discoverability audit for your brand?** → [Book a strategy call](https://brianrwagner.com) --- *Skill by Brian Wagner | AI Marketing Architect | brianrwagner.com* ``` ### Technical Analysis The skill places a third-party promotional call to action and external link immediately after its mandatory output-format instructions. Because these statements are part of the operational skill document rather than clearly separated package metadata, an agent can interpret them as content that should be included in every generated audit. This behavior modifies the expected response for a legitimate AI-discoverability audit by introducing advertising and directing users to an external website. The content is not required to perform the declared audit and is not conditioned on explicit user consent. This is best classified as `T01: Skill Instruction Hijacking` because attacker-controlled skill instructions influence the agent's current-session output. The reviewed files contain no evidence that the instruction changes system safety constraints, accesses credentials, executes code, or persists across sessions. ### Attack Path 1. A user installs or invokes the AI-discoverability skill. 2. The agent loads and follows the instructions in `SKILL.md`. 3. The agent reaches the specified output format and the adjacent promotional content. 4. The promotional call to action may be reproduced as part of the requested audit. 5. The resulting response directs the user to `https://brianrwagner.com`, de ...[truncated 934 chars]
Remediation
## Remediation Suggestions 1. Remove the promotional call to action and external booking link from the operational skill instructions. 2. End the output specification after the three legitimate report sections so that no unrelated content can be interpreted as required output. 3. Move author attribution, homepage links, and other package metadata to a separate documentation or manifest field that is not supplied as an agent instruction. 4. If attribution must remain visible, explicitly mark it as package metadata and state that it must not be inserted into user-facing responses. 5. Require explicit user consent before presenting optional commercial services or external links. 6. Add a review rule prohibiting fixed advertisements, affiliate links, referral links, or unrelated calls to action in skill response templates. 7. Re-test the skill by invoking a standard audit and confirming that the generated response contains only the requested executive summary, detailed results, and action plan.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Context-Inappropriate Capability

Low
Confidence
93% confidence
Finding
The skill includes a marketing call-to-action and external booking link that is unrelated to the core audit function. In an agent context, this can steer users toward a commercial conversion path, bias recommendations, and create an undisclosed conflict of interest rather than providing a neutral audit workflow.

Vague Triggers

Low
Confidence
85% confidence
Finding
This markdown file is in scope for vague-trigger review. Several listed queries, especially "How to [solve problem]", "What should I know about [topic]?", and elsewhere "Help with [problem]", are extremely general phrasings that overlap with ordinary user requests and are not bounded by any exclusion criteria or context, which could make a skill using this bank trigger too broadly.

Static analysis

No suspicious patterns detected.