ClawHub
Back to skill

Security audit

Software Engineer for projects

Security checks for vulnerabilities and agentic risk

Overview

The skill is largely a disclosed project-coordination workflow, but it can automatically act on persistent queue files and mutate Asana/project state with some ambiguous authority.

Install only in a managed OpenClaw project where the project folder, queue files, and Asana permissions are controlled. Before use, clarify who may move tasks to Blocked and consider requiring confirmation before the skill updates persistent files or Asana state from queue-only messages.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (8)

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The access boundary says the engineer has read-only repo access and presents the skill as primarily analytical, but later instructions direct the skill to modify numerous files in the project workspace, including queue files, STATE.md, SHARED_MEMORY.md, KNOWN_ISSUES.md, RUNBOOK.md, and IMPLEMENTATION_GUIDE.md. That behavior materially exceeds a simple read/analyze role as described in the boundary section, even if some writes are coordination artifacts rather than repository pushes.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/repo_operations.md (reported line 5)May include surrounding context.

md
Standard git workflows for the Project Engineer.

**External Dependency:** All git commands in this file are executed through the separately loaded `git_essentials` skill (or equivalent git tooling skill). That skill manages repository credentials and access tokens. This file defines *procedures and standards* only — it does not execute commands directly.

**Access Model:** Read-only. The engineer clones, pulls, checks out branches, and diffs. It never pushes, merges, deletes, or modifies repository content.

Session Persistence

Medium
Category
Rogue Agent
Confidence
86% confidence
Finding

The skill is designed around persistent cross-session coordination through queue files, heartbeat state, project folders, and audit-trail documents. While persistence is operationally intentional, it increases security risk because stale or adversarially planted workspace content can steer future sessions, cause unauthorized continuation of prior tasks, or create hidden state dependence that bypasses fresh user intent.

Content

Scanner excerpt · SKILL.md (reported line 6)May include surrounding context.

md
description: >
  Project Engineer skill — the technical authority for software development agent teams.
  Use this skill whenever an engineering agent needs to: analyze or audit existing codebases,
  produce technical assessments for the PM, create Engineering Design & Implementation Plans
  (frontend specs, backend specs, DB schema specs, QA specs), review developer branches,
  handle dev escalations, produce Asana task manifests, or coordinate with the PM on
  requirements alignment. Also handles the Asana heartbeat queue check every 30 minutes —

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger phrase set is extremely broad and includes generic engineering terms like code audit, branch review, architecture decisions, and task breakdown. In a multi-skill agent environment, this can cause unintended activation, leading the skill to inspect repositories, read queue files, or write project coordination artifacts in contexts where the user did not intend those actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill authorizes writing and modifying multiple workspace and queue files, yet it does not require an explicit user-facing notice or confirmation before making those changes. In practice, a user may invoke what appears to be an analysis or planning skill and inadvertently trigger persistent state changes, which is dangerous in shared agent workspaces because it can alter task flow, audit trails, and downstream agent behavior.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 314)May include surrounding context.

text

Rules:
- Each section must be complete enough that the dev can implement without asking questions during normal execution
- No full code — approach-level only
- Reference `KNOWN_ISSUES.md` items where relevant
- When you update the guide mid-sprint (due to a spec gap or escalation resolution), add an entry to the Change Log section at the bottom and post to `queues/to-pm.md` noting the update

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The dev escalation workflow instructs the engineer to move an Asana task to Blocked after a hard stop, but the later Asana Column Reference explicitly says the engineer does not move Blocked tasks and that this is the PM's responsibility. These instructions directly contradict each other and create intent-code divergence in the operational procedure.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

The heartbeat section states the skill only defines behavior when a heartbeat session starts and does not self-invoke or persist, but the surrounding manifest positions the skill as actively handling a 30-minute heartbeat queue check as part of its duties. While not a code contradiction in the executable sense, the documentation mixes passive instruction-only framing with operational ownership in a way that can misstate what the skill actually causes an agent to do.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.