ClawHub
Back to skill

Security audit

Thought Experiment

Security checks for vulnerabilities and agentic risk

Overview

This is a markdown-only reasoning skill for structured thought experiments, with no executable code or hidden high-impact behavior found.

Installers should expect this skill to make the agent use a more formal reasoning template for counterfactual, strategic, or ethical questions. If broad activation is annoying, narrow the trigger phrases locally; no sensitive access or execution behavior was found.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The activation criteria are overly broad and include very common conversational phrases like 'what if' and 'imagine that,' which can cause the skill to trigger in many ordinary interactions outside its intended scope. This can lead to inappropriate routing, unnecessary override of more relevant skills, and increased prompt-surface exposure because the agent may enter a structured reasoning mode when the user did not actually request it.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · examples/galileo-einstein-strategic-applications.md (reported line 30)May include surrounding context.

md
**Bezos's 1000x Amazon experiment.** "What if Amazon were 1000 times larger? What infrastructure would be needed? What products / services would have to exist?" The thought experiment forced consideration of computing infrastructure at scale. The realization: Amazon's internal infrastructure (compute, storage, databases) would itself be a sellable product. AWS launched 2006 and grew into a $80 billion+ business by 2024 — entirely driven by the prior thought experiment that asked "what would be true if we were 1000x larger?"

**Bezos's regret-minimization framework.** When deciding whether to leave D.E. Shaw and start Amazon in 1994, Bezos used a thought experiment: "Imagine I'm 80, looking back at my life. Will I regret not having tried Amazon?" The thought experiment surfaced the long-term regret framing that led to the decision. See [`regret-minimization`](../skills/regret-minimization/SKILL.md).

**Charlie Munger's "invert always invert."** Munger's discipline of thinking backward from disaster is a class of thought experiment: imagine the catastrophic outcome, work backward to what could cause it, then design to prevent. See [`inversion`](../skills/inversion/SKILL.md).

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · examples/galileo-einstein-strategic-applications.md (reported line 32)May include surrounding context.

md
**Bezos's regret-minimization framework.** When deciding whether to leave D.E. Shaw and start Amazon in 1994, Bezos used a thought experiment: "Imagine I'm 80, looking back at my life. Will I regret not having tried Amazon?" The thought experiment surfaced the long-term regret framing that led to the decision. See [`regret-minimization`](../skills/regret-minimization/SKILL.md).

**Charlie Munger's "invert always invert."** Munger's discipline of thinking backward from disaster is a class of thought experiment: imagine the catastrophic outcome, work backward to what could cause it, then design to prevent. See [`inversion`](../skills/inversion/SKILL.md).

**Premortem analysis** (Klein 2007). The structured premortem is a thought experiment with specific format: imagine the project has failed catastrophically 12 months from now; reason backward to what went wrong; surface failure modes that prospective planning misses. See [`premortem`](../skills/premortem/SKILL.md).

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · examples/galileo-einstein-strategic-applications.md (reported line 34)May include surrounding context.

md
**Charlie Munger's "invert always invert."** Munger's discipline of thinking backward from disaster is a class of thought experiment: imagine the catastrophic outcome, work backward to what could cause it, then design to prevent. See [`inversion`](../skills/inversion/SKILL.md).

**Premortem analysis** (Klein 2007). The structured premortem is a thought experiment with specific format: imagine the project has failed catastrophically 12 months from now; reason backward to what went wrong; surface failure modes that prospective planning misses. See [`premortem`](../skills/premortem/SKILL.md).

**Rawls's veil of ignorance** (1971). A famous ethical-policy thought experiment: imagine you must design society without knowing whether you'll be born rich/poor, strong/weak, talented/limited. What principles would you choose? The thought experiment surfaces hidden interests in policy debates.

Static analysis

No suspicious patterns detected.