ClawHub
Back to skill

Security audit

Challenge Loop

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed adversarial-review helper with bounded subagent use and no evidence of hidden persistence, exfiltration, destructive behavior, or unrelated file access.

Before installing, be aware that casual review phrases may activate the skill and subagent modes can send your current request and draft to an ephemeral challenger, adding cost and latency. Use the documented skip phrases when you want a direct answer without the challenge loop.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Skill Enumeration

Medium
Category
Agent Snooping
Content
### Hermes
```bash
cp SKILL.md ~/.hermes/skills/challenge-loop/SKILL.md
```

### OpenClaw / Claude Code
Confidence
80% confidence
Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Vague Triggers

Medium
Confidence
97% confidence
Finding
The trigger phrase "any issues?" is broad, natural conversational language that can easily appear in ordinary user interactions unrelated to this skill. In a skill that alters agent behavior by adding adversarial review, accidental invocation can cause unintended workflow changes, unnecessary latency/cost, or interference with the user’s requested task.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The trigger phrase "review this" is highly generic and overlaps with common requests users make in many contexts. Because this skill can spawn challenger subagents and revise outputs iteratively, unintended activation could trigger unnecessary subagent execution, added cost, altered outputs, or confusion about why the agent changed behavior.

Description-Behavior Mismatch

Medium
Confidence
98% confidence
Finding
The skill metadata and body conflict: the front matter says the skill is always manually triggered, but the trigger section explicitly allows the agent to self-initiate inline challenge for 'high-risk' outputs. This creates a trust-boundary problem because operators may rely on manifest-level guarantees when deciding whether a skill can run autonomously, leading to unexpected activation and behavior changes.

Vague Triggers

Medium
Confidence
97% confidence
Finding
Several listed triggers are common conversational phrases such as 'help me see if there are problems,' 'is this reliable,' or 'think again,' which can appear in ordinary dialogue outside an intentional skill invocation. Because the skill can alter response structure and potentially spawn subagents, broad trigger phrases increase the chance of accidental activation, unexpected cost, and unanticipated data exposure to challenger subagents.

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
This is the same underlying issue expressed in operational documentation: 'Agent discretion' overrides the earlier 'Always manually triggered' claim. In environments that gate permissions or user expectations based on trigger mode, this inconsistency can cause unauthorized or surprising execution paths, especially if downstream platforms interpret the manifest as authoritative.

Natural-Language Policy Violations

Low
Confidence
79% confidence
Finding
The phrase "Multi-language trigger phrases (English + Chinese)" describes language-specific behavior, but this changelog entry does not indicate whether users can choose or opt into the language/locale behavior. Under the policy rule, language constraints or behavior should be explicitly optional or justified to avoid unintended locale assumptions.

Static analysis

No suspicious patterns detected.