ClawHub
Back to skill

Security audit

personal-assistant

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed personal briefing toolkit that writes local files and fetches public/keyless data, with some operational and compliance caveats but no evidence of hidden or malicious behavior.

Install only if you want a local, scheduled personal briefing system. Review the cron jobs before enabling them, keep outputs in private paths, configure only your own sites for link checking, and disable the YouTube transcript fetcher if the Android-client workaround or third-party content terms are not acceptable.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (9)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The code is consistent with one subset of the declared description—watchlist-driven market briefs from keyless data. It reads tickers from a markdown watchlist, queries Yahoo Finance for price/volume changes, queries Google News RSS for headlines, and stores generated brief JSON files. However, the declared purpose describes a much broader multi-function assistant with several additional capabilities that are absent from this code chunk. This is a description-to-behavior mismatch because the supplied code chunk does not accurately represent the full declared functionality and instead implements only the market brief engine portion.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The description claims a bundled assistant with several distinct capabilities beyond markets. This code chunk is narrowly focused on one subset: building market/news briefs for US or India using keyless quote/news sources plus a local watchlist file. That subset does align with the 'daily market brief' / 'brief me on my stocks' portion of the declaration, but the overall declared purpose materially overstates what this code actually does. There are no signs of unrelated harmful behavior or undeclared sensitive access; the mismatch is that the description advertises several major capabilities absent from the code.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The declared description presents a multi-function personal assistant for markets, research, reading workflows, site monitoring, and dashboarding. The supplied code only performs one limited function: fetching and cleaning transcripts plus chapter metadata for the latest Bloomberg Surveillance episode from YouTube and saving it locally. While this loosely overlaps with the declared 'video-transcript' aspect and could support a market briefing workflow, the primary purpose and scope are materially narrower than described. There is no evidence of watchlist tracking, daily digest assembly, stock briefing logic, reading-list summarization, audio output, site monitoring, or dashboard functionality. Therefore the description does not accurately represent what this code chunk actually does.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill advertises operational workflows that involve file reads/writes, network access, and shell-style scheduling, but it does not declare any explicit tool scope or permission boundaries. In an agent environment, this increases the chance of over-privileged execution or unintended access because the runtime cannot enforce least privilege from the manifest alone.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Broad trigger phrases like "personal assistant" and "daily digest" are generic enough to match ordinary conversation, which can cause unintended invocation of a skill that may perform network, file, or scheduling actions. In a skill with operational side effects, accidental activation can lead to unauthorized data collection, file changes, or confusing autonomous behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The query string forces hl=en-US, gl=US, and ceid=US:en, which imposes a specific language and locale regardless of the user's market selection or preferences. This is a natural-language locale policy issue because the skill does not offer opt-in or explain why US English is required.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The script explicitly configures yt-dlp to impersonate an Android YouTube client to bypass platform bot checks. In a personal-assistant skill, this is an evasion technique rather than a necessary feature, and it increases legal, compliance, and platform-abuse risk while normalizing anti-detection behavior in the automation pipeline.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/surveillance_fetch.py (reported line 36)May include surrounding context.

python
def run(*args, check=True):
    p = subprocess.run(YTDLP + BASE_ARGS + list(args),
                       capture_output=True, text=True, timeout=300)
    if check and p.returncode != 0:
        raise RuntimeError(f"yt-dlp failed: {p.stderr.strip()[:300]}")

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
67% confidence
Finding

The docstring asserts the output is 'for PERSONAL CONSUMPTION ONLY' and 'Never synced to B2 or the website,' but the implementation writes generated transcript markdown into ~/workspace/briefs/us, which appears intended for downstream assistant content processing rather than an isolated personal-only location. That documentation overstates a usage restriction the code itself does not enforce.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.