ClawHub
Back to skill

Security audit

Doc-First Research

Security checks for vulnerabilities and agentic risk

Overview

This skill tells the agent to consult official documentation before answering uncertain tool, API, or configuration questions, with no executable code or persistence.

Install this if you want the agent to verify tool and API questions against official docs before answering. Expect more external documentation fetches, and consider narrowing the trigger language if you only want this behavior when you explicitly ask for documentation lookup.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger conditions are extremely broad, including generic states like 'any uncertain operation' and 'when encountering an error'. In an agent setting, that can cause the skill to activate in many unrelated contexts and push the agent to fetch external documentation or change workflow unexpectedly, increasing the chance of unintended network access, policy bypass, or disruption of safer higher-priority instructions.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

md
| 字节扣子 (Coze) | https://www.coze.cn/docs/ |
| 微信小程序 | https://developers.weixin.qq.com/miniprogram/dev/framework/ |
| Telegram Bot API | https://core.telegram.org/bots/api |
| DeepSeek | https://api.deepseek.com/docs |
| Slack API | https://api.slack.com/ |
| Discord API | https://discord.com/developers/docs |
| GitHub API | https://docs.github.com/rest |

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

md
| 微信小程序 | https://developers.weixin.qq.com/miniprogram/dev/framework/ |
| Telegram Bot API | https://core.telegram.org/bots/api |
| DeepSeek | https://api.deepseek.com/docs |
| Slack API | https://api.slack.com/ |
| Discord API | https://discord.com/developers/docs |
| GitHub API | https://docs.github.com/rest |
| Notion API | https://developers.notion.com/docs/getting-started |

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The instruction explicitly states that English documentation should be used as primary and Chinese only as auxiliary. This imposes a language preference without offering the user a choice or framing it as an opt-in, which can violate language/locale neutrality expectations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.