ClawHub
Back to skill

Security audit

Clarity Annotate

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Clarity Protocol annotation helper that discloses its external API use and API-key requirements.

Install only if you intend agents to submit or retrieve Clarity Protocol annotations. Keep CLARITY_WRITE_API_KEY scoped to this service, review annotation content before posting because it leaves the local environment, and avoid invoking the submit workflow for private notes.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill explicitly requires environment secrets and internet access, but it does not declare any tool scope or permission boundaries. That creates a real security issue because an agent runtime may invoke the skill without clearly constraining network and env access, increasing the chance of unintended secret exposure or overbroad external communication.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The trigger language is broad enough that an agent could invoke this skill for loosely related requests like noting observations or literature connections without strong user confirmation. Because the skill performs authenticated write operations to an external service, ambiguous invocation criteria can cause unintended data submission, incorrect annotations, or abuse of the API key-backed write capability.

Description-Behavior Mismatch

Medium
Confidence
82% confidence
Finding
The module is documented as a shared Clarity Protocol client for both read and write operations, and its `api_get()` helper is generic enough to query arbitrary API endpoints. The manifest describes a narrowly focused annotation skill that submits annotations and lists annotations, not a general-purpose Clarity API client with broad read capability.

External Transmission

Medium
Category
Data Exfiltration
Content
url = API_BASE + endpoint

    try:
        response = requests.post(
            url,
            json=data,
            headers=get_headers(write=True),
Confidence
80% confidence
Finding
This code transmits caller-supplied data to an external service using a write-capable API key, which is inherently security-relevant because it can send sensitive or unreviewed content outside the local trust boundary. In the context of an annotation-submission skill, outbound POSTs are expected, but the generic helper increases the chance of misuse if upstream inputs are not tightly validated and endpoint usage is not constrained.

Intent-Code Divergence

Low
Confidence
76% confidence
Finding
The file documentation presents this as a shared client for Clarity Protocol broadly, including generic GET access, while the skill manifest positions the skill as specifically for annotation submission and annotation listing. This creates an intent-level documentation mismatch by describing a broader purpose than the skill is supposed to serve.

Static analysis

No suspicious patterns detected.