ClawHub
Back to skill

Security audit

Debugging

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent debugging guide, but it can prompt broad activation and unsafe diagnostic logging of environment and signing-credential details.

Review before installing. Use this only if you want a strict debugging workflow, and do not run or publish its environment, keychain, certificate-store, or GPG examples in CI logs, shared terminals, issue trackers, or support bundles without redacting sensitive values. Prefer presence checks over printing values and require explicit approval before credential-store diagnostics.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)

Missing User Warnings

High
Confidence
97% confidence
Finding
The skill explicitly instructs users to add diagnostic instrumentation and log inputs, outputs, environment/config propagation, and component state across boundaries, but it provides no safeguards for secrets, tokens, keys, or personal data. In real systems, this can easily leak sensitive material into logs, CI output, shell history, or shared debugging artifacts, especially because the guidance includes environment inspection and credential-store enumeration.

Credential Access

High
Category
Privilege Escalation
Content
echo "=== Env vars in build script: ==="
env | grep IDENTITY || echo "IDENTITY not in environment"

# Layer 3a: macOS keychain / macOS 钥匙串
echo "=== macOS keychain state: ==="
security list-keychains
security find-identity -v
Confidence
94% confidence
Finding
The example tells the user to inspect environment variables with `env | grep IDENTITY`, which can expose sensitive signing-related variables and normalize the practice of printing credential-associated environment data during debugging. In CI or shared terminals, even partial credential disclosure or identification of available secrets can aid further compromise.

Credential Access

High
Category
Privilege Escalation
Content
env | grep IDENTITY || echo "IDENTITY not in environment"

# Layer 3a: macOS keychain / macOS 钥匙串
echo "=== macOS keychain state: ==="
security list-keychains
security find-identity -v
Confidence
91% confidence
Finding
The instruction to run `security list-keychains` reveals keychain configuration and available stores on macOS systems. While not always disclosing secret contents, it exposes credential storage layout and can provide useful reconnaissance about available signing infrastructure on the host.

Credential Access

High
Category
Privilege Escalation
Content
# Layer 3a: macOS keychain / macOS 钥匙串
echo "=== macOS keychain state: ==="
security list-keychains
security find-identity -v

# Layer 3b: Windows certificate store / Windows 证书存储
Confidence
95% confidence
Finding
The command `security find-identity -v` enumerates signing identities available in the macOS keychain, exposing certificate and identity metadata that can reveal what credentials exist on the system. In shared debugging contexts, this creates credential reconnaissance risk and may disclose sensitive operational details about code-signing assets.

Vague Triggers

Medium
Confidence
96% confidence
Finding
The trigger list includes very common words such as "why" and broad failure phrases like "not working," which can cause the skill to activate in many normal conversations unrelated to debugging. In an agent environment, over-broad auto-triggering can unexpectedly steer the model into this skill’s rigid workflow, interfering with user intent and creating prompt-selection hijacking or denial-of-service style behavior against more appropriate skills.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The trigger guidance is extremely broad and includes generic issue descriptions like unexpected behavior, performance problems, and user phrases such as "why" and "有问题." This overlaps with common troubleshooting language and does not clearly distinguish when the skill should activate versus when it should not.

Natural-Language Policy Violations

Low
Confidence
72% confidence
Finding
The README presents English and Chinese sections, but the activation phrases are hardcoded to specific English and Chinese terms rather than describing user-selectable language behavior. This can create a locale policy concern because the skill appears to assume fixed languages for invocation instead of explicitly offering language choice or documenting a justified locale constraint.

Static analysis

No suspicious patterns detected.