ClawHub
Back to skill

Security audit

ClawForage Research Agent

Security checks for vulnerabilities and agentic risk

Overview

This skill locally analyzes existing knowledge-base markdown and writes research reports, with no evidence of hidden exfiltration or unsafe privilege use.

Before installing, understand that the skill reads local harvested knowledge markdown and saves source lists and reports under memory/. If your knowledge directory mixes unrelated domains or private material, run it only on the intended subset.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The code partially matches the declared purpose because it does perform entity extraction over knowledge-base Markdown files. However, the broader description overstates the behavior. There is no real implementation of cross-article connection analysis; the script only aggregates entities across files and outputs frequency counts, without linking entities or identifying relationships between articles. It also does not generate structured domain reports—only plain text lists headed '=== ENTITIES ===' and '=== TOP ENTITIES BY FREQUENCY ==='. Additionally, the comment says it extracts entities from 'Key facts: sections', but the code contains no logic specific to those sections. No undeclared sensitive permissions or resource access are present, but the primary purpose as described is materially broader than the implemented functionality.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared purpose suggests an analytical/research capability that processes knowledge sources to extract entities, find relationships, and create structured reports. The actual code only checks a supplied markdown report for presence of predefined section names and basic file existence/content. This is a materially different primary purpose: validation of an already-written report rather than conducting research or generating one. No undeclared dangerous behavior is present, but the implementation does not match the advertised functionality.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

This markdown file states that source whitelists are auto-created on first run and shows manual creation under the memory directory, which implies local file writes. The description does not include any explicit warning that the skill will create or modify files in the user's workspace or memory storage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

This shell script performs a destructive filesystem operation by recursively removing the temporary directory with rm -rf. Although the temp directory is internally created by mktemp, there is no confirmation, print/log message, or explanatory warning near the deletion to disclose that cleanup will occur.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.