ClawHub
Back to skill

Security audit

TalonForge Launch Blitz (EN/AR)

Security checks for vulnerabilities and agentic risk

Overview

This is a simple launch playbook, but it directs the agent to submit and monitor a product across many public platforms without clear per-platform confirmation or monitoring limits.

Install only if you are comfortable with an agent helping publish launch information publicly. Before use, require it to draft materials first, approve each platform submission separately, avoid confidential or premature product details, and set explicit limits for any post-launch monitoring.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill advertises simultaneous submission to many external platforms but does not warn users that product details, pricing, URLs, competitor information, and launch timing may be propagated to multiple third parties. This can cause accidental disclosure of sensitive business information, violate user expectations, and create compliance or reputational risks if the data is inaccurate, confidential, or not yet ready for public release.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger phrase "Run the launch blitz" is broad and provides no scoping, confirmation, or consent boundaries before the agent begins preparing or potentially facilitating submissions. In a skill that coordinates publication across 21 third-party platforms, an underspecified trigger increases the risk of unintended bulk actions, premature disclosure of product information, or user confusion about what the agent will actually do.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The post-launch section describes ongoing monitoring of approvals, activity, upvotes, comments, and traffic without disclosing boundaries, data sources, retention, or user consent. Persistent tracking behavior can surprise users, expand the scope of data collection over time, and create privacy or account-monitoring concerns, especially if the agent accesses third-party services or aggregates engagement data continuously.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.