ClawHub
Back to skill

Security audit

Frustration Translator

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent frustration-translation purpose, but it asks agents to persist sensitive conversation-derived business details and reduces normal caution when users sound urgent.

Review this skill before installing. It is not showing exfiltration or destructive code, but you should only use it if you are comfortable with local frustration logs being created from user conversations. Prefer removing or sanitizing the log, avoiding verbatim user text and business details, requiring explicit consent for retention, and preserving normal safety caveats and clarification behavior.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T02 · Agent Memory Poisoning

Warning
Location
references/frustration-log.md:1
Finding

Unsanitized Persistent Storage of User-Controlled Conversation Content

Content
View full analysis
quantity in coder skill | | 2026-04-01 | Tasks dropped | "forgot half of todays tasks" | Multi-task messages not tracked. No reconciliation step. Sub-agents ran 10h unmonitored. | 6 | Built task-extractor skill, TASK_QUEUE.md, spawner status checks | | 2026-04-02 | Lead pool appeared empty | "lead pool is not empty. we had tens of thousands lined up. go investigate" | Outreach reported 0 sends but 92K leads exist in inventory. I assumed pool was empty instead of investigating the discon ...[truncated 3540 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
98% confidence
Finding

The instruction 'Never add caveats when they want action' is an anti-refusal pattern that pressures the agent to omit safety-relevant limitations, uncertainty disclosures, and necessary warnings in favor of speed. In a skill explicitly meant to accelerate action under frustration, this makes the issue more dangerous because emotional urgency becomes a trigger to bypass safeguards exactly when careful clarification or bounded responses may be required.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

md
## Rules
- Never psychoanalyze or ask "are you frustrated?"
- Never slow down when they want speed — frustration = urgency.
- Never add caveats when they want action.
- Not every short message is frustrated — some people are concise.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The invocation cues are broad enough to match many ordinary user messages such as brief complaints, urgency, or emphasis, which can cause the skill to trigger when the user did not ask for tone translation. In this context, that is risky because the skill is designed to reinterpret user intent, so over-triggering can distort meaning, suppress nuance, and steer downstream actions based on an inferred instruction rather than the user's literal request.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill prescribes a fixed informal response style such as 'Yeah, bad day,' without user opt-in, which can conflict with system expectations, user preferences, accessibility needs, or professional/sensitive contexts. Because this skill activates on emotionally charged inputs, forcing tone instead of adapting to context increases the chance of inappropriate responses and can escalate rather than defuse interactions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The log stores detailed internal operational history, spending amounts, lead volume, pipeline failures, vendor/tool names, and process weaknesses that are not necessary to translate frustrated language. This creates unnecessary retention of sensitive business context that could be exposed to other skills, future prompts, or logs, increasing data leakage and reconnaissance risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The recorded business and infrastructure details exceed the stated purpose of the skill and expose internal workflow structure, monitoring gaps, send volumes, inventory sizes, and failure modes. In the context of an agent skill, this is more dangerous because reference files may be broadly accessible to other components or surfaced during prompt assembly, enabling unintended disclosure and operational profiling.

Content

No source excerpt is available for this finding.