ClawHub
Back to skill

Security audit

C/C++ Comprehensive Cheat Sheets

Security checks for vulnerabilities and agentic risk

Overview

This is a C/C++ reference skill that fetches examples from a fixed documentation site, with no executable code, persistence, credential use, or hidden local actions found.

Install this if you are comfortable with the agent using cppcheatsheet.com as a live reference for C/C++ and systems-programming answers. Avoid invoking it with proprietary or sensitive code if you do not want any task context used around external reference fetching.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
94% confidence
Finding
The skill advertises an extremely broad scope, including shell scripting, system administration, networking tools, assembly, debugging, and general development tasks, which increases the chance it will be invoked for requests outside a narrowly bounded C/C++ reference use case. Overbroad routing can expose users to unnecessary external fetching and code-generation behavior in contexts where a more specialized or safer skill should apply.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill mandates always using WebFetch against a third-party site before answering, but it does not warn that user prompts, code snippets, or sensitive task context may be transmitted to an external domain. This creates a data exposure risk, especially when users ask about proprietary code, internal build systems, debugging crashes, or security-sensitive C/C++ implementations.

Static analysis

No suspicious patterns detected.