ClawHub
Back to skill

Security audit

Proof

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Proof document integration that uses Proof's hosted API as disclosed, with no bundled code, installer, or hidden persistence.

Install this only if you are comfortable with Proof document URLs, share tokens, document contents, and agent presence/activity being sent to proofeditor.ai when you use the skill. Avoid sharing sensitive Proof links unless you intend the agent to access and edit that document.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill instructs the agent to immediately join a shared Proof document, read state, and publish presence as soon as a URL is shared, which transmits the user's token and agent activity to a third-party service without an explicit consent checkpoint. In this context, that can disclose access credentials and metadata to an external system before the user understands or approves the action.

Persistent Context Injection

Medium
Category
Memory Poisoning
Content
- Work in the Proof doc unless the user explicitly asks you to move elsewhere.

When creating new docs, follow this priority order:
1. If persistent instructions already define a Proof default mode, use it.
2. Otherwise default to `collaborative_docs`.

Supported default modes:
Confidence
80% confidence
Finding
Skill injects content designed to persist in agent memory or context across interactions. Persistent injection can alter agent behavior long after the initial interaction.

External Transmission

Medium
Category
Data Exfiltration
Content
Read state and show presence on read:

```bash
curl -sS "https://www.proofeditor.ai/api/agent/<slug>/state" \
  -H "Authorization: Bearer <token>" \
  -H "X-Agent-Id: <your-agent-id>"
```
Confidence
95% confidence
Finding
This endpoint usage sends a bearer token and agent identifier to an external service and is coupled with instructions to perform the action immediately on receipt of a URL. The danger is not the existence of an API call itself, but that the skill normalizes external transmission of credentials and presence data without a prior trust, privacy, or consent check.

External Transmission

Medium
Category
Data Exfiltration
Content
Get a snapshot:

```bash
curl -sS "https://www.proofeditor.ai/api/agent/<slug>/snapshot" \
  -H "Authorization: Bearer <token>"
```
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Natural-Language Policy Violations

Low
Confidence
75% confidence
Finding
The line requires every write to include a fixed `by: "ai:<agent-name>"` value, which imposes a specific labeling convention in natural-language instructions. While this may be operationally useful, the file does not indicate user opt-in or explain why this fixed identity format is required as a policy exception.

Static analysis

No suspicious patterns detected.