ClawHub
Back to skill

Security audit

tdd

Security checks for vulnerabilities and agentic risk

Overview

This documentation-only TDD skill is purpose-aligned, with broad triggers and forceful workflow rules users should notice before installing.

Install this if you want a strict test-first workflow. Be aware that broad words like "verify" or "not working" may route the agent into writing or running tests early, and the skill may guide visible git commits as part of TDD practice.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Unvalidated Output Injection

High
Category
Output Handling
Confidence
85% confidence
Finding

Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

Content

Scanner excerpt · cycle.md (reported line 15)May include surrounding context.

md
|---|-------|-----|
| 1 | After tdd invocation, jump to "current behavior diagnosis → medium decision ask" (skipping Red authoring) | First action after tdd invocation = TaskCreate (`Red`, `Green`, `Refactor`, `Verify`) + Red test authoring + execution |
| 2 | "Root cause found = decide solution medium" thinking (Red step deprioritized) | Even after root cause is found, author + execute Red first to secure regression-prevention evidence. Medium decision is part of Green step |
| 3 | After diagnosis report, immediately AskUserQuestion "how to solve?" | Author Red + execute (confirm failure + report output) → then ask about Green medium |
| 4 | "Regression test is authored after implementation" thinking (Test-After) | TDD = Test-First. Red is mandatory before any implementation/deployment |
| 5 | Skipping Red authoring and going straight to Green under the pretext of "environment constraint blocks Red execution" | Author Red (test file in committable state) → state execution-blocked reason → plan CI/manual verification medium → Green |

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The invocation scope is not clearly constrained: the description lists many trigger terms but does not define exclusions, precedence, or required context, while the body adds a rigid "HARD STOP" behavior requiring a first action before diagnosis or planning. In combination, ambiguous triggering can lead to accidental invocation of a forceful workflow that overrides normal safe assistance behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The invocation scope is not clearly constrained: the description lists many trigger terms but does not define exclusions, precedence, or required context, while the body adds a rigid "HARD STOP" behavior requiring a first action before diagnosis or planning. In combination, ambiguous triggering can lead to accidental invocation of a forceful workflow that overrides normal safe assistance behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrase "verify" is overly broad and can cause this skill to activate in many unrelated contexts, increasing the chance that the agent performs test-discovery or test-execution guidance when the user did not intend to invoke it. In a coding assistant context, broad activation expands the attack surface for prompt/skill routing mistakes and can be abused to steer the agent into operational behaviors based on ambiguous language.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.