ClawHub
Back to skill

Security audit

Model Handoff

Security checks for vulnerabilities and agentic risk

Overview

This skill is not malicious, but it can persist sensitive handoff details and future-agent instructions in workspace files without a clear approval step.

Install only if you want agents to create and maintain HANDOFF.md in your project. Before use, require the agent to show diffs and ask before editing HANDOFF.md or AGENTS.md, omit personal details unless explicitly needed, and do not record secrets, API keys, credential filenames, or secret locations.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The skill explicitly instructs storing user personal profile information such as name, role, location, and preferences in a shared handoff artifact. That exceeds what is necessary for model continuity and creates unnecessary privacy exposure, especially because HANDOFF.md is described as a workspace file that may be read by future models or shared across contexts.

Vague Triggers

Medium
Confidence
85% confidence
Finding
The skill authorizes proactive use during long sessions and for broad situations like token-saving or model rotation, which can cause the agent to persist context without a clear, current user request. In a security-sensitive setting, that increases the risk of silently writing sensitive operational context to disk and normalizes background data retention.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The update triggers are ambiguous and broad, including 'significant project milestone' and 'several hours with significant new context,' which leaves too much discretion to the agent to decide when to persist information. That makes over-collection and unnecessary retention more likely, especially when the file may include project state, agent roster, and pointers to credential-related artifacts.

Static analysis

No suspicious patterns detected.