ClawHub
Back to skill

Security audit

ARCHITECT: Autonomous Goal Execution for AI Agents

Security checks for vulnerabilities and agentic risk

Overview

The skill is an openly autonomous planning/execution helper with no bundled code, dependencies, or hidden install behavior, though users should understand that it encourages broad agent autonomy.

Install only if you want the agent to take a proactive planning-and-execution style. For sensitive work, state the scope up front, require confirmation before memory writes, and do not rely on the skill to send, publish, delete, or use credentials without your explicit approval.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Vague Triggers

High
Confidence
95% confidence
Finding
The execution-mode triggers are common natural-language words like "build," "create," "review," and "fix," so ordinary prompts can silently activate stronger autonomous behaviors than the user intended. In a skill explicitly designed to execute multi-step goals without follow-up questions, broad trigger overlap increases the chance of overreach, mis-scoped actions, and unsafe automation from ambiguous user input.

Vague Triggers

High
Confidence
97% confidence
Finding
The skill defines broad trigger phrases such as common goal-oriented language that users may say in ordinary conversation, which can cause the skill to activate unintentionally and take over interaction style. In the context of an autonomous execution skill, accidental activation materially increases the chance of the agent shifting into a high-autonomy workflow and performing sensitive planning or persuasive prompting the user did not explicitly request.

Vague Triggers

High
Confidence
98% confidence
Finding
The activation table maps very common phrases like "I need to..." and "Help me achieve..." to autonomous behavior modes, making activation insufficiently constrained. Because this skill is specifically designed to decompose goals and proceed with limited questioning, these ambiguous triggers can lead to unintended autonomy, suppression of normal clarification, and unsafe execution patterns.

Natural-Language Policy Violations

Medium
Confidence
92% confidence
Finding
The example explicitly generates content in Greek for outreach messaging without any indication that the user requested Greek or opted into language-specific output. In an autonomous execution skill, this normalizes the agent making unilateral communication choices on the user's behalf, which can cause miscommunication, exclusion, or inappropriate outreach when the inferred language is wrong.

Natural-Language Policy Violations

Medium
Confidence
89% confidence
Finding
Claiming to extract the user's "real goal" invites the skill to reinterpret or override explicit instructions, which can cause it to act on inferred intent rather than stated scope. In an autonomous executor, this is dangerous because small misreadings can propagate into task decomposition and execution, leading to unauthorized actions, scope expansion, or outputs the user did not request.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
ARCHITECT operates in two zones. The boundary is always clear:

```
ZONE 1 — FULLY AUTONOMOUS (no confirmation needed):
  ✓ Task sequencing and ordering
  ✓ Approach selection within a task
  ✓ Adaptation when a task fails
Confidence
89% confidence
Finding
The skill explicitly authorizes a 'fully autonomous' zone with no confirmation needed for a broad class of decisions, including research, reading files, task adaptation, and quality judgments. While it reserves confirmation for some external state changes, this still encourages the agent to act with reduced user oversight and can bypass normal clarification safeguards, especially when combined with broad activation conditions elsewhere in the skill.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
| "I need to..." | Parse goal, confirm scope, execute |
| "Help me achieve..." | ARCHITECT + APEX strategy mode |
| "Plan and execute..." | Full autonomous loop |
| "Do [X] without asking me questions" | SPRINT MODE, maximum autonomy |
| "Figure out what's wrong with..." | AUDIT MODE |
| "Research and give me a report on..." | RESEARCH MODE |
| "Take this from idea to done" | BUILD MODE, maximum depth |
Confidence
93% confidence
Finding
The trigger phrase "Do [X] without asking me questions" instructs the skill to maximize autonomy and minimize interaction, directly incentivizing the agent to skip clarifications that are often necessary for safety, scope control, and consent. In an autonomous executor skill, this meaningfully raises the likelihood of overbroad action, misinterpretation of user intent, and unsafe progression toward sensitive operations.

Static analysis

No suspicious patterns detected.