ClawHub
Back to skill

Security audit

Learning Loop

Security checks for vulnerabilities and agentic risk

Overview

This skill is a transparent workspace-local journaling and memory system, with persistent behavior that is expected for its purpose but should be used deliberately.

Install only if you want the agent to maintain workspace-local journals, lessons, and memory over time. Periodically review brain/ and MEMORY.md, avoid storing sensitive personal or credential data, and prefer scoped confirmations such as project-only or domain-only rules when asked to make a correction permanent.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The "Use when" list includes very broad, everyday situations such as "setting up a new agent," "want structured decision tracking," and "agent keeps repeating mistakes" without defining clear trigger phrases or exclusion conditions. In a markdown skill description, this can make it unclear when the skill should activate versus when similar ordinary requests should not invoke it.

Persistent Context Injection

Medium
Category
Memory Poisoning
Content
- Same correction 1x → tentative, watch for repetition
- Same correction 2x → emerging pattern
- Same correction 3x → ask user: "Should I always do X? (Yes always / Only in [context] / Case by case)"
- User confirms → promote to permanent rule
- User says case-by-case → keep as contextual note

**Learning signals** (phrases that trigger logging):
Confidence
95% confidence
Finding
The skill instructs the agent to convert repeated corrections into a 'permanent rule,' which can persistently modify future behavior based on prior interactions. Even though user confirmation is requested, this creates a context-injection risk where adversarial or mistaken instructions can become long-lived behavioral rules and influence unrelated future tasks.

Static analysis

No suspicious patterns detected.