ClawHub
Back to skill

Security audit

Daily Workflow Manager

Security checks for vulnerabilities and agentic risk

Overview

This skill is a transparent project handoff and daily workflow note manager, with expected workspace documentation writes but no hidden code execution, network access, or credential handling.

Install only if you want the agent to maintain persistent project notes in your workspace. Review the generated Docs/ and .workbuddy files periodically, and do not let the skill store secrets, credentials, private personal details, or anything you would not want future AI sessions to read.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Memory Manipulation

High
Category
Memory Poisoning
Confidence
86% confidence
Finding

The skill is explicitly designed to preserve and transfer context across AI sessions by writing persistent memory into project files. While this is not overtly malicious, persistent memory can become a channel for retaining sensitive instructions, user preferences, or hidden prompt material beyond the immediate session, increasing privacy and instruction-persistence risk.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: daily-workflow-en
description: "Daily work start, mid-day check-in, and end workflow manager for English-speaking developers. Triggered by customizable phrases (default: 'starting work', 'lunch time', 'ending work'). Manages project documentation (Docs/ folder): PROJECT_TARGET.md, PROJECT_STATUS.md, COMPLETED_JOBS.md, PENDING_JOBS.md, and NEXT_STEPS.md. Ensures smooth AI-to-AI project handover with clear context preservation."
agent_created: true
---

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manifest and title specify an English-only variant for 'English-speaking developers', which is a natural-language locale restriction. While the file later mentions support for mixed Chinese and English trigger phrases, it does not offer the user a language/locale choice for the skill itself or justify why English is required.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs the agent to create and repeatedly modify files in the workspace, including a config file and multiple project documents, without requiring explicit user confirmation before writes. This can lead to unintended file changes, overwrites, or persistent state creation that the user did not knowingly authorize, especially because the workflow is triggered by simple phrases.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The handover guidance tells the agent to record detailed context, user preferences, decisions, and workarounds for future AI instances without any data minimization rules. This creates a real risk of persisting sensitive or unnecessary user-provided information into project documentation where it may later be exposed or misused.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 268)May include surrounding context.

md
Write all documentation assuming the next reader will be a different AI instance that needs to:
- Understand what was being built and why
- Resume work without asking basic questions
- Continue the same coding style and conventions
- Respect decisions already made

Static analysis

No suspicious patterns detected.