ClawHub
Back to skill

Security audit

Comment

Security checks for vulnerabilities and agentic risk

Overview

The skill is local-only, but it persistently saves arbitrary text under vague comment-related commands without clear retention or deletion controls.

Install only if you are comfortable with a local CLI that records the text you pass to it under ~/.local/share/comment. Do not enter secrets, tokens, private notes, or sensitive business data unless you intend them to be saved locally, and review or remove that directory manually if needed.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (8)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill advertises itself as a comment-management terminal utility, but the documented behavior shows a much broader data-capture and logging mechanism across many unrelated commands. That mismatch is dangerous because users may provide sensitive inputs to commands that appear functional while the skill persistently stores and exposes them through history, stats, search, recent activity, and export features without clear permission or retention disclosure.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The invocation text 'Use when you need comment' is overly broad and vague, which increases the chance the skill is invoked in contexts unrelated to safe comment management. In combination with its logging behavior, this can cause unnecessary collection and persistence of user-provided data that the user did not reasonably expect to be stored.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The advertised purpose is comment management, but the exposed command set is a generic data collection and logging utility with capabilities unrelated to that description. This mismatch is dangerous because users may trust the skill with comment-related data while it actually provides broader storage and handling behavior than expected, increasing the risk of unintended data capture and misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The export routine writes a consolidated copy of logged data to disk without clearly warning users what content will be included or the privacy implications of creating a portable aggregate file. This increases exposure because previously scattered local records become a single easy-to-copy artifact containing all captured entries.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The core command handlers accept arbitrary user input and persist it to local log files rather than performing narrowly scoped comment-management actions. This creates a covert data-retention surface where sensitive text entered by users may be stored indefinitely under many command names, contrary to the stated purpose of the skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

These command paths store user-supplied input into persistent local files without prominently warning the user that their input will be retained. This is dangerous because users may enter secrets, tokens, internal notes, or other sensitive content assuming ephemeral processing, but the script silently creates a lasting record.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The markdown explicitly promotes automatic history and activity logging but does not warn users about retention, sensitivity of stored inputs, or how to disable or clear logs. This is risky because users may enter secrets, internal data, or other sensitive text assuming commands are ephemeral when they are actually written to disk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The export function aggregates all stored logs into JSON, CSV, or TXT files, enabling easy bulk extraction of previously captured user inputs. In the context of a skill presented as simple comment management, this broad export capability expands the blast radius of any sensitive data that was logged and makes secondary disclosure more likely.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.