Security audit

EverClaw

Security checks for vulnerabilities and agentic risk

Overview

This is a real local research knowledge-base skill, but it needs Review because it can run broad autonomous web/PDF collection, persist local data and inferred interests, and activate across sessions.

Install only if you are comfortable with an always-on research assistant that can search the web, download and retain raw web/PDF material, spawn subagents, and keep cross-session learning state. Before use, review the knowledge directory, proactive mode, cron examples, source acquisition rules, and deletion controls; avoid confidential, regulated, or copyrighted material unless you have clear rights and storage limits.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The description frames the skill as a local knowledge-base assistant, but the workflow performs autonomous web research, downloading, and browser-based searching. That broadens the trust boundary from local retrieval to unbounded remote content intake, increasing exposure to malicious pages and unexpected data collection.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The skill silently derives topics from user questions and persists them in a proactive queue across sessions. This is background behavioral logging unrelated to answering a single query, and it can capture sensitive interests without informed consent.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: Radar mode performs broad category-wide news surveillance and writes learning candidates to persistent storage, which exceeds the narrow purpose of answering from a local KB. This creates unnecessary network activity and expands collection of user-adjacent interest profiles over time.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The prompt explicitly instructs the subagent to search for and fetch book PDFs and 'full text' from third-party repositories such as archive.org, pdfdrive.com, and similar sources. That creates a real risk of unauthorized acquisition and local storage of copyrighted material, which exceeds the stated need of building a cited knowledge base and exposes the operator to legal, policy, and data-handling risk.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The README explicitly advertises autonomous web research and persistence of downloaded materials to a local knowledge base, but it does not clearly warn users that invoking learning will trigger network access and local file writes. In an agent skill context, this matters because users may assume a documentation or Q&A plugin is passive, while the skill actually performs data ingestion and storage that can affect privacy, bandwidth, disk usage, and compliance expectations.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: Documenting `--auto` as suitable for Cron encourages unattended execution of recurring web access and local data ingestion, yet the README provides no adjacent warning about the operational and security consequences of autonomous runs. In this context, unattended execution increases risk because repeated fetch/store behavior can consume resources, ingest untrusted content at scale, and operate without a user noticing unexpected activity.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The README explicitly promotes autonomous web research and persistent local storage of downloaded sources, but it does not clearly warn users that invoking the skill can trigger network access and write potentially large amounts of data to disk. In an agent setting, hidden outbound access and persistent collection materially affect privacy, consent, and operational safety, especially if users assume the skill is purely local or informational.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The auto-mode description says it can deepen all incomplete topics for Cron, implying unattended background execution, but it does not warn that this may continue fetching remote content and accumulating local data without active user review. In a long-running or scheduled environment, this increases the risk of unexpected network activity, storage growth, and collection of sensitive or policy-restricted material.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The invocation scope overlaps with ordinary domain questions and the skill is marked always-on, increasing the chance of triggering filesystem inspection or KB interception during normal conversation. Broad auto-activation magnifies the impact of all other risky behaviors in the file.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill instructs silent session-start inspection of local files and state without notifying the user. Hidden filesystem access undermines transparency and can reveal prior activity, learned topics, and preferences before the user asks for the skill.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill describes autonomous downloading and persistent storage but does not require a clear upfront warning or consent at the point of use. Users may ask a domain question and unknowingly trigger network access and local retention.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The manifest enables the skill with "always": true, causing it to load in every session without an explicit user trigger or scoped activation condition. For a skill that performs persistent local knowledge-base access and autonomous research, unconditional activation increases attack surface, privacy exposure, and the chance that its instructions influence unrelated conversations.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The template directs automated downloading and writing of multiple local files and status artifacts without any explicit disclosure, confirmation gate, or user opt-in at execution time. In a skill with persistent local storage, silent filesystem modification increases the risk of unexpected data accumulation, privacy issues, and abuse if the prompt is triggered in broader contexts.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The prompt instructs network access to external search engines and direct PDF downloads, including fallback to Google in the browser, without warning the user that queries and target URLs will be sent to third parties. This can leak sensitive research topics, identifiers, or workspace intent and is especially concerning in a persistent research skill that may operate on user-supplied topics.

Ssd 3

Medium

Confidence: 98% confidence
Finding: The skill persistently logs inferred user interests and knowledge gaps to disk without informing the user. Because these topics are derived from conversation content, the queue can become a durable profile of sensitive questions, intentions, or research areas.

Ssd 1

High

Confidence: 95% confidence
Finding: The prompt begins with a role override that tells the subagent to ignore parts of the main agent's normal instruction set and operate only within a narrower task frame. This is dangerous because it weakens inherited safeguards and creates a prompt-isolation boundary where risky file, network, and data-acquisition behaviors can proceed with reduced oversight.

Ssd 4

Medium

Confidence: 89% confidence
Finding: The template suppresses user-visible progress while requiring hidden heartbeat and completion files on disk, creating a control flow that minimizes operator visibility into ongoing actions. In the context of a skill that performs external retrieval and persistent storage, hidden state updates materially reduce transparency and make misuse or overreach harder to detect.

Static analysis

No suspicious patterns detected.