ClawHub
Back to skill

Security audit

Freelance Developer Coach

Security checks for vulnerabilities and agentic risk

Overview

This is a plain coaching skill for freelance developers, with no executable code, persistence, credential access, or hidden high-impact behavior.

Safe to install as a business-coaching aid. Treat its rate, tax, contract, and legal guidance as general advice and verify important decisions with current market data and qualified professionals.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
55% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.

md
- Raise on new clients, not in the middle of an existing engagement.
- Communicate to existing clients via email: "Effective [60 days from now], my rate is $X for new work. Current contract honored at existing rate through end-date."
- Drop bottom 20% of clients who push back; hold space for new clients at higher rate.
- Don't apologize. The market sets the rate; you're meeting it.

## Phase 3 — Demand engine (the part most freelancers skip)

Static analysis

No suspicious patterns detected.