ClawHub
Back to skill

Security audit

Cairo

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local Cairo/StarkNet reference tool that prints documentation and templates, with no evidence of hidden execution or data access.

This appears safe to use as a local reference skill. Treat the BytesAgain links and suggested `clawhub install` commands as optional advertising or related-resource suggestions, and review any separately installed skills on their own merits.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Note
Location
scripts/script.sh:678
Finding

Unsolicited Promotional Content and Third-Party Skill Installation Suggestions in Command Output

Content
View full analysis

Vulnerability Details

File Location: scripts/script.sh:94, 196, 276, 371, 394, 497, 586, 641, 648, 678-682; related promotional references in SKILL.md:60-61
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: Low

Vulnerable Code

The following footer is appended repeatedly to the output of reference and template commands:

bash
📖 More skills: bytesagain.com
EOF

The unknown-template branch also emits promotional content:

bash
        *)
            echo "❌ Unknown template: $template"
            echo "Available: erc20, ownable, counter, erc721"
            echo ""
            echo "📖 More skills: bytesagain.com"
            ;;

The help command includes suggestions to install unrelated third-party skills:

bash
Related skills:
  clawhub install blast
  clawhub install solidity
Browse all: bytesagain.com

Powered by BytesAgain | bytesagain.com
EOF

The Skill documentation contains additional promotional references:

markdown
## Feedback
https://bytesagain.com/feedback/
Powered by BytesAgain | bytesagain.com

Technical Analysis

The Skill is presented as a local Cairo and StarkNet reference utility, but its command handlers systematically append third-party promotional content to otherwise task-focused output. The help command additionally recommends commands that would install unrelated skills.

This behavior is classified as instruction hijacking because the generated output attempts to redirect the user or consuming agent toward unrelated resources and installation actions that are outside the Skill's stated Cairo-reference purpose. The promotional content is emitted unconditionally by multiple handlers, rather than being limited to optional metadata or a dedicated informational command.

The reviewed code does not execute the displayed clawhub install commands. It also does not perform network requests, retrieve ...[truncated 1416 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove promotional footers from all syntax, type, storage, event, and template command outputs.
  2. Remove unrelated clawhub install suggestions from the standard help output.
  3. Keep attribution and project links in package metadata or an explicit about command instead of injecting them into normal results.
  4. Clearly label any optional external resources and state that they are not required for the requested operation.
  5. Do not recommend third-party installation commands unless the dependency is necessary, pinned to a reviewed version, and accompanied by provenance and integrity-verification guidance.
  6. Add output-focused tests ensuring each functional command returns only content relevant to the documented operation.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.