ClawHub
Back to skill

Security audit

Wyld Stallyns: Be Excellent 🎸

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed persona-coaching skill made of Markdown and JSON, with no hidden code execution or data access.

Install only if you want the agent to use stylized historical-persona perspectives in advice. Be aware that forging or retiring legends can change this skill's local roster, and treat financial, relationship, or life guidance as reflective coaching rather than professional advice.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (8)

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
80% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · assets/legends/twyla-tharp.md (reported line 19)May include surrounding context.

md
Tharp wakes at 5:30am, hails a cab to the gym, and works out for two hours. Every day. The ritual isn't the workout — it's hailing the cab. Once she's in the cab, the rest is inevitable. Creativity isn't about waiting for inspiration. It's about building a ritual that makes inspiration irrelevant.

### 02. The Box
Every project gets a cardboard box. Tharp throws everything related into it: notes, clippings, ideas, objects. The box is permission to collect without judging. When it's time to create, she has raw material. Start every project with a box.

### 03. Scratching
Before a piece is formed, you have to "scratch" — dig for ideas, follow hunches, make ugly attempts. Most scratching produces nothing useful. That's the point. You scratch until something catches. Creativity isn't waiting for lightning. It's scratching until you make sparks.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The 'When to Invoke Shackleton' section uses broad triggers such as 'Everything has gone wrong' and 'Feeling overwhelmed by scale of problem' without clear boundaries, exclusions, or specific trigger phrases. These conditions could match many ordinary user situations, increasing the chance of unintended or overly frequent invocation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The 'When to Invoke Tubman' section uses generic conditions like 'Fear is blocking necessary action' and 'Need courage for a difficult conversation' without clear boundaries or exclusions. These triggers are broad enough to match many ordinary conversations, and the file provides no negative examples or narrow context to limit activation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown file defines activation guidance using broad phrases like 'facing a conflict' and 'playing a long game,' which could match many ordinary conversations and make invocation boundaries unclear. The section does not provide constraints, explicit trigger phrases, or negative examples to limit when the skill should or should not activate.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The 'When to Summon Franklin' section uses broad phrases like 'Want to improve but don't know where to start' and 'Need to design systems/habits for change,' which are common everyday requests rather than narrowly scoped triggers. The file does not provide exclusion conditions or more specific constraints to clarify when this persona should activate versus other skills.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The 'When to Invoke Munger' section uses generic conditions such as 'Need to see a problem from multiple angles' and 'Want to avoid predictable mistakes' without clear scope or exclusions. These phrases are broad enough to match many ordinary conversations, which can cause unintended activation of the skill.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The 'When to Summon Musashi' section lists high-level situations like 'Facing competition or conflict' and 'Building a long-term skill,' which are broad enough to overlap with many ordinary contexts. The file does not provide explicit trigger phrases, boundaries, or negative examples to clarify when this skill should or should not be invoked.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The 'When to Summon Twyla' section lists vague conditions such as 'Need to build creative discipline' and 'Struggling with consistency in creative work' without defining scope, exclusions, or specific trigger phrases. Because this is a markdown file and the activation guidance is broad and open-ended, it could cause unintended invocation in common productivity conversations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.