ClawHub
Back to skill

Security audit

paywalls

Security checks for vulnerabilities and agentic risk

Overview

This is a text-only paywall optimization skill with no executable code, persistence, or hidden system access; its main caveat is privacy care around personalization advice.

Reasonable to install for in-product paywall and upgrade-flow work. Before using its personalization experiments, make sure your team has consent or another lawful basis for analytics use, avoids sensitive attributes, and documents targeting rules. Expect it to read local product-marketing context files if those exist.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · references/experiments.md (reported line 157)May include surrounding context.

md
- Cool-down period after dismiss (hours vs. days)
- Escalating urgency over time vs. consistent messaging
- Once per feature vs. consolidated prompts
- Re-show rules after major engagement

### Dismiss Behavior
- "Maybe later" vs. "No thanks" vs. "Remind me tomorrow"

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manifest description says to use the skill when the user mentions phrases like "upsell," "feature gate," or "how do I get users to pay," and also for "any in-product moment where you're asking users to upgrade." These triggers are broad and lack negative examples or tighter scope boundaries, which could cause unintended invocation for general product, monetization, or UX discussions that are not specifically about paywall optimization.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The evaluation explicitly expects the skill to trigger on casual phrasing such as a broad question about upgrade prompts, which can cause overbroad routing and activation without clear user intent boundaries. In a skill-selection or agent-routing context, this increases the chance the paywalls skill is invoked for adjacent topics, leading to inappropriate persuasion-oriented guidance where another skill or a neutral response would be more suitable.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The document encourages personalization using usage data, behavior patterns, user names, traffic sources, and segment-specific targeting without any guardrails around consent, data minimization, fairness, or compliance. In a paywall-optimization skill, this can normalize collecting and using potentially sensitive behavioral data for monetization in ways that create privacy, profiling, and discrimination risks.

Content

No source excerpt is available for this finding.