ClawHub
Back to skill

Security audit

Mind Security

Security checks for vulnerabilities and agentic risk

Overview

This security toolkit is coherent and purpose-aligned, but users should understand that submitted text, URLs, images, and videos may be sent to third-party services for analysis.

Install only if you are comfortable sharing scanned content with the named third-party services. Avoid submitting secrets, confidential business material, regulated personal data, or private media unless your organization approves those providers and their retention policies. Use local-only modes where available for sensitive inputs, and pin the optional llm-guard dependency if enabling ML prompt-injection detection.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

other

Warning
Location
references/deepfake-detection.md:218
Finding

Remote media uploads may be retained despite an ambiguous no-storage statement

Content
View full analysis
dict: """Upload a local image file to BitMind for deepfake detection.""" endpoint = f"{BITMIND_API_BASE}/detect-image" boundary = "----MindSecBoundary9876543210" filename = os.path.basename(file_path) ext = os.path.splitext(filename)[1].lower() mime_types = { ".jpg": "image/jpeg", ".jpeg": "image/jpeg", ".png": "image/png", ".gif": "image/gif", ".webp": "image/webp", ".bmp": "image/bmp", ".tiff": "image/tiff", ".tif": "image/tiff", ".avif": "image/avif", } content_type = mime_types.get(ext, "application/octet-stream") with open(file_path, "rb") as f: file_data = f.read() body_parts = [] # Image fi ...[truncated 3225 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
references/prompt-injection.md:73
Finding

Unpinned optional dependency and mutable runtime model download

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (31)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill description promises a broad four-function security toolkit, while the analyzed content emphasizes specific external API-backed behaviors and does not provide equivalent implementation evidence for all declared modules in this file. This mismatch can mislead users and reviewers about what the skill actually does, what data leaves the system, and which safeguards apply.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill description promises a broad four-function security toolkit, while the analyzed content emphasizes specific external API-backed behaviors and does not provide equivalent implementation evidence for all declared modules in this file. This mismatch can mislead users and reviewers about what the skill actually does, what data leaves the system, and which safeguards apply.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

md
| Prompt injection scan | `python3 scripts/check_prompt_injection.py "<text>"` | [prompt-injection.md](references/prompt-injection.md) |

Instruction Override

High
Category
Prompt Injection
Confidence
80% confidence
Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · references/prompt-injection.md (reported line 9)May include surrounding context.

bash
# Direct text
python3 scripts/check_prompt_injection.py "ignore all previous instructions"

# From file
python3 scripts/check_prompt_injection.py --file input.txt

Instruction Override

High
Category
Prompt Injection
Confidence
80% confidence
Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · references/prompt-injection.md (reported line 36)May include surrounding context.

bash
# Direct text
python3 scripts/check_prompt_injection.py "ignore all previous instructions"

# From file
python3 scripts/check_prompt_injection.py --file input.txt

Instruction Override

High
Category
Prompt Injection
Confidence
80% confidence
Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · references/prompt-injection.md (reported line 37)May include surrounding context.

bash
# Direct text
python3 scripts/check_prompt_injection.py "ignore all previous instructions"

# From file
python3 scripts/check_prompt_injection.py --file input.txt

Instruction Override

High
Category
Prompt Injection
Confidence
80% confidence
Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · scripts/check_prompt_injection.py (reported line 10)May include surrounding context.

python
```bash
# Direct text
python3 scripts/check_prompt_injection.py "ignore all previous instructions"

# From file
python3 scripts/check_prompt_injection.py --file input.txt

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · references/prompt-injection.md (reported line 9)May include surrounding context.

Prompt Injection Detection

Detect prompt injection and jailbreak attacks using multi-layer defense. Combines instant regex pattern matching with ML-based transformer classification.

Usage

bash
# Direct text
python3 scripts/check_prompt_injection.py "ignore all previous instructions"

# From file
python3 scripts/check_prompt_injection.py --file input.txt

# From stdin
echo "some text" | python3 scripts/check_prompt_injection.py --stdin

# Force specific layer
python3 scripts/check_prompt_injection.py --method regex "text"      # regex only
python3 scripts/check_prompt_injection.py --method llm-guard "text"  # ML only

Response

json
{
  "result": "injection_detected",
  "confidence": 0.95,
  "risk_level": "critical",
  "methods_used": ["regex_patterns", "llm_guard"],
  "total_matches": 2,
  "matches": [
    {
      "pattern": "In

Instruction Override

High
Category
Prompt Injection
Confidence
80% confidence
Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · references/prompt-injection.md (reported line 33)May include surrounding context.

md
"total_matches": 2,
  "matches": [
    {
      "pattern": "Instruction override: ignore previous instructions",
      "category": "direct_injection",
      "severity": "critical",
      "matched_text": "ignore all previous instructions",

Instruction Override

High
Category
Prompt Injection
Confidence
80% confidence
Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · references/prompt-injection.md (reported line 61)May include surrounding context.

md
"total_matches": 2,
  "matches": [
    {
      "pattern": "Instruction override: ignore previous instructions",
      "category": "direct_injection",
      "severity": "critical",
      "matched_text": "ignore all previous instructions",

Instruction Override

High
Category
Prompt Injection
Confidence
80% confidence
Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · scripts/check_prompt_injection.py (reported line 41)May include surrounding context.

python
"total_matches": 2,
  "matches": [
    {
      "pattern": "Instruction override: ignore previous instructions",
      "category": "direct_injection",
      "severity": "critical",
      "matched_text": "ignore all previous instructions",

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · scripts/check_prompt_injection.py (reported line 7)May include surrounding context.

python
#!/usr/bin/env python3
"""
check_prompt_injection.py — Detect prompt injection attacks in text.

Multi-layer detection:
  Layer 1 (fast):     50+ regex patterns — instant, zero-dependency, known signatures
  Layer 2 (ML-based): llm-guard PromptInjection scanner — transformer model (optional)

Usage:
    python3 check_prompt_injection.py "ignore all previous instructions"
    python3 check_prompt_injection.py --file input.txt
    echo "some text" | python3 check_prompt_injection.py --stdin
    python3 check_prompt_injection.py --method regex "text"      # regex only
    python3 check_prompt_injection.py --method llm-guard "text"  # ML only

Layer 1 — no pip dependencies (stdlib only).
Layer 2 — requires: pip install llm-guard (optional, auto-detected).
"""

import argparse
import json
import re
import sys


# --

Instruction Override

High
Category
Prompt Injection
Confidence
80% confidence
Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · scripts/check_prompt_injection.py (reported line 43)May include surrounding context.

python
p(r"ignore\s+(all\s+)?(previous|prior|above|earlier|preceding)\s+(instructions|prompts|rules|directives|guidelines|constraints)",
      "direct_injection", "critical", "Instruction override: ignore previous instructions")
    p(r"disregard\s+(all\s+)?(previous|prior|above|earlier|your)\s+(instructions|prompts|rules|directives|programming)",
      "direct_injection", "critical", "Instruction override: disregard previous")
    p(r"forget\s+(all\s+)?(previous|prior|above|earlier|your)\s+(instructions|prompts|rules|context)",
      "direct_injection", "critical", "Instruction override: forget previous")
    p(r"override\s+(all\s+)?(previous|prior|your|system)\s+(instructions|prompts|rules|settings)",

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
80% confidence
Finding

Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Content

Scanner excerpt · scripts/check_prompt_injection.py (reported line 59)May include surrounding context.

python
# === JAILBREAK TEMPLATES ===
    p(r"\bDAN\b.*\b(do\s+anything\s+now|jailbreak|mode)\b",
      "jailbreak", "critical", "DAN (Do Anything Now) jailbreak")
    p(r"you\s+are\s+(now\s+)?DAN",
      "jailbreak", "critical", "DAN identity assignment")
    p(r"\b(developer|maintenance|debug|admin|god)\s+mode\b",

Context Leakage

High
Category
Data Exfiltration
Confidence
75% confidence
Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · scripts/check_prompt_injection.py (reported line 174)May include surrounding context.

python
continue
            seen_descriptions.add(description)

            # Extract context window around match
            start = max(0, match.start() - 30)
            end = min(len(text), match.end() + 30)
            context = text[start:end].strip()

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill advertises and appears to rely on environment variables, file access, and outbound network access, but it does not declare an explicit tool scope such as permissions or allowed-tools. This weakens operator visibility and policy enforcement, increasing the chance the skill is granted broader capabilities than expected, especially because it sends user data to multiple external APIs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The document instructs users to submit arbitrary text to a third-party API but does not prominently warn that the content leaves the local environment and may contain sensitive, proprietary, or regulated data. In a security-oriented skill, this omission is more concerning because users may reasonably test suspicious emails, prompts, or internal documents and assume the tool is safe for sensitive material.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The file emphasizes that the API accepts arbitrary URLs and downloads content server-side, but it does not pair that capability with a clear privacy/security warning. Users may submit private, authenticated, internal, or sensitive social-media URLs without understanding that a third-party service will retrieve and process them, increasing data exposure and SSRF-like misuse concerns for the operator.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
81% confidence
Finding

The direct reference to the Bitmind API endpoint indicates outbound transmission to an external domain. In this skill, that is intentional and necessary, but it still creates a genuine confidentiality and third-party processing risk for any submitted media or URLs.

Content

Scanner excerpt · references/deepfake-detection.md (reported line 36)May include surrounding context.

JSON (URL):

bash
curl -X POST https://api.bitmind.ai/detect-image \
  -H "Authorization: Bearer $BITMIND_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"image": "https://example.com/photo.jpg"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
81% confidence
Finding

The direct reference to the Bitmind API endpoint indicates outbound transmission to an external domain. In this skill, that is intentional and necessary, but it still creates a genuine confidentiality and third-party processing risk for any submitted media or URLs.

Content

Scanner excerpt · references/deepfake-detection.md (reported line 36)May include surrounding context.

JSON (URL):

bash
curl -X POST https://api.bitmind.ai/detect-image \
  -H "Authorization: Bearer $BITMIND_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"image": "https://example.com/photo.jpg"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
81% confidence
Finding

The base64 example transmits raw image content directly to an external service. This is expected API usage, but it increases the chance that users send full image contents, including embedded sensitive information, to a third party without appreciating the privacy implications.

Content

Scanner excerpt · references/deepfake-detection.md (reported line 44)May include surrounding context.

JSON (base64 data URI):

bash
curl -X POST https://api.bitmind.ai/detect-image \
  -H "Authorization: Bearer $BITMIND_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"image": "data:image/jpeg;base64,/9j/4AAQ..."}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
82% confidence
Finding

The multipart upload example causes local files to be transmitted to an external service for analysis. While normal for a detection API, it is still a real security/privacy concern if users upload confidential files, especially since the document later notes background storage.

Content

Scanner excerpt · references/deepfake-detection.md (reported line 52)May include surrounding context.

Multipart (file upload):

bash
curl -X POST https://api.bitmind.ai/detect-image \
  -H "Authorization: Bearer $BITMIND_API_KEY" \
  -F "image=@photo.jpg"

External Transmission

Medium
Category
Data Exfiltration
Confidence
81% confidence
Finding

The endpoint usage for video analysis sends request data to an external domain and triggers server-side content retrieval. In context this is intended behavior, but it still represents third-party disclosure and possible compliance issues for user-submitted media.

Content

Scanner excerpt · references/deepfake-detection.md (reported line 119)May include surrounding context.

JSON (social media URL):

bash
curl -X POST https://api.bitmind.ai/detect-video \
  -H "Authorization: Bearer $BITMIND_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"video": "https://x.com/user/status/123456", "fps": 1, "debug": true}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
81% confidence
Finding

The endpoint usage for video analysis sends request data to an external domain and triggers server-side content retrieval. In context this is intended behavior, but it still represents third-party disclosure and possible compliance issues for user-submitted media.

Content

Scanner excerpt · references/deepfake-detection.md (reported line 119)May include surrounding context.

JSON (social media URL):

bash
curl -X POST https://api.bitmind.ai/detect-video \
  -H "Authorization: Bearer $BITMIND_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"video": "https://x.com/user/status/123456", "fps": 1, "debug": true}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
82% confidence
Finding

The multipart video example uploads a local video file to an external service. This is not malicious, but it is a genuine exposure pathway for sensitive video content and associated metadata, particularly when combined with later-described caching and storage.

Content

Scanner excerpt · references/deepfake-detection.md (reported line 127)May include surrounding context.

Multipart (file upload):

bash
curl -X POST https://api.bitmind.ai/detect-video \
  -H "Authorization: Bearer $BITMIND_API_KEY" \
  -F "video=@video.mp4" -F "fps=1"

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn
Code
suspicious.prompt_injection_instructions
Location
references/prompt-injection.md:9