ClawHub
Back to skill

Security audit

Soul Question

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent prompt-only reflection helper, with no hidden execution, persistence, or data exfiltration found.

Use this skill only with text you are comfortable giving to your current AI environment. Redact secrets, credentials, regulated data, and confidential business details before pasting; the artifact itself does not add storage, network calls, or privileged local access.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (8)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

There is a clear description-behavior mismatch. The declared purpose describes an end-user skill for producing deep introspective questions from arbitrary context. However, the actual code chunk only performs static validation of skill documentation and metadata files for a 'Soul Question' package. Its primary purpose is QA/testing of the skill bundle, not question generation, context analysis, or user interaction. This is not a mere supporting detail; it is a materially different function from the declared description.

Content

No source excerpt is available for this finding.

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
85% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 139)May include surrounding context.

md
1. **Less is more**: 1 real soul question beats 3 that merely sound deep
2. **Anchor to specifics**: The user must be able to trace every question back to "which part of my material did you see this in?"
3. **No disguised advice**: "Have you considered doing X?" is advice in question form — don't do this
4. **Challenge, don't judge**: Questions should provoke thought, not make someone feel attacked
5. **No formulaic openers**: Avoid "Have you ever thought about…", "What if…", or other coaching clichés
6. **Match language**: Output in the same language as the input material

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README states that the "Output matches your input language automatically," which imposes a language/locale behavior by default. Under the policy, language behavior should not be forced without giving the user a choice or clearly documenting a justified locale constraint.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger phrases are broad conversational requests like 'deep question' and 'challenge my thinking', which can activate on ordinary dialogue and cause the agent to process large amounts of personal or workplace text unexpectedly. In a skill designed to mine 'cognitive cracks' from sensitive materials, overbroad activation increases privacy and safety risk because users may not realize this more invasive mode has engaged.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill explicitly invites users to paste chat logs, meeting notes, journals, and work documents, all of which commonly contain sensitive personal, employment, or confidential business information. Without a clear warning or consent language, users may disclose material they would otherwise withhold, creating privacy, confidentiality, and compliance exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The description explicitly states the skill reads conversations, meeting notes, journals, and other potentially sensitive text, but it provides no privacy notice, data handling disclosure, or warning about submitting confidential information. This creates a real privacy risk because users may paste highly sensitive personal or business content without understanding retention, transmission, or secondary-use implications.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The comments and checks require SKILL.md and README.md to contain no CJK characters and label this as 'English only' for a global audience. This is a natural-language locale policy constraint that forces a specific language without offering a user choice or documenting a region-specific justification.

Content

No source excerpt is available for this finding.