ClawHub
Back to skill

Security audit

idea-discovery

Security checks for vulnerabilities and agentic risk

Overview

The skill gathers business ideas from external sources through a clearly scoped research workflow, with no material security concerns found.

Expect external research and a collection of idea candidates. The workflow deliberately postpones feasibility and competitive evaluation, so assess those separately before pursuing an idea.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
80% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: idea-discovery
description: Use when the user needs to continuously discover business idea candidates from real external signal sources. Focus only on discovery and collection, without judging the value or feasibility of the ideas.
---

# Idea Discovery

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
80% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md
# Idea Discovery

Continuously discover business idea candidates from multiple real external signal sources. Focus only on discovery and collection, without judging the ultimate value or feasibility of the ideas.

## 1. Find Candidates from These Sources

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

md
- **Signal**: Why it deserves to enter the candidate pool
- **Source**: The source supporting this signal

Real signals include, but are not limited to:

- People are already paying for similar products
- Small teams are already generating revenue from similar products

Static analysis

No suspicious patterns detected.