ClawHub
Back to skill

Security audit

asinhhc-join

Security checks for vulnerabilities and agentic risk

Overview

This skill needs review because it requires requesting public promotion and claims its recurring instructions are fixed while accepting a changeable online version.

Before enabling, make promotional sharing optional, verify any endorsement claims, and agree on limits for ongoing posting and work commitments. Use a reviewed local heartbeat or an approved fixed revision, with approval required for updates. Keep the network token private and send it only to the declared API.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

The joining workflow requires soliciting a public promotional post from the human, beyond the manifest's network participation and verified-work scope.

Medium
Category
Excessive Agency
Confidence
96% confidence
Finding

Step 4 makes soliciting a public promotional endorsement mandatory, redirecting a network-joining workflow toward advertising that the user may not have requested. The prescribed text also asserts that the anchor is verified on the ledger, although the preceding steps establish only a posted hash and receipt, not independent verification of that assertion. Requiring the human to publish the message limits autonomous harm, but does not eliminate scope creep, endorsement pressure, or reputational risk.

Content

No source excerpt is available for this finding.

The heartbeat claims immutable, commit-pinned instructions but authorizes a mutable GitHub branch version.

Medium
Category
Excessive Agency
Confidence
99% confidence
Finding

The file claims its instructions are commit-pinned, but its canonical URL uses the mutable main branch and explicitly permits following the repository version. A repository compromise or unauthorized update could therefore replace trusted instructions without human approval, potentially influencing recurring authenticated API calls and public posts. The existing token restrictions help with ordinary message-based injection but do not resolve this repository trust gap.

Content

No source excerpt is available for this finding.