ClawHub
Back to skill

Security audit

brief-yourself

Security checks for vulnerabilities and agentic risk

Overview

This skill manages a local, consent-gated personal context store and does not show hidden execution, exfiltration, or automatic memory access.

Install only if you want a Chinese-first workflow that stores personal context in local files. Review each authorization card, avoid approving broad history or memory reads unless needed, and use the private/restricted, downstream persistence, apply-patch, and purge approvals deliberately.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (16)

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

The skill presents itself as a consent-driven personal-context management workflow, but the described operational center is local file-based view validation and adapter processing rather than the full interview, authorization, store update, and patch review lifecycle. This mismatch is dangerous because users or orchestrators may grant trust, sensitive inputs, or broader invocation rights under false assumptions about what the skill actually does and does not enforce.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill describes and routes operations that involve reading and writing local files via Python scripts, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization transparency gap: a caller or reviewer cannot easily tell that filesystem access is required, which can lead to overbroad execution in environments that infer capabilities from content rather than explicit policy.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest description forces a specific language presentation for the skill's user-facing behavior, but the file does not offer the user a language/locale choice or justify that the skill is intentionally region-specific. Under the policy, imposing a language without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger criteria are broad enough to capture common self-exploration and task-preparation requests, which increases the chance of the skill being invoked in situations beyond its narrowly safe operating assumptions. In a skill handling personal context and potentially sensitive user data, overbroad activation can cause unnecessary collection, exposure, or processing of personal information.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The target framing strings are hard-coded in Chinese for all targets, and the markdown renderer uses them directly in the user-facing output. This imposes a specific language/locale choice without any user opt-in or clear documentation that the adapter is intentionally region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The rendered markdown always includes Chinese prose explaining how to interpret the context view, regardless of user preference or environment. Under the policy, forcing a specific language without opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill specification is written entirely in Chinese and gives all operational instructions, field semantics, and review/apply requirements only in that language. This creates a language-policy concern because it implicitly requires Chinese comprehension without stating that the skill is China/Chinese-specific or offering an alternative language path.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The human-readable export hardcodes the placeholder text （无） when claims or sources are absent. This imposes a specific language in generated output without offering a user language choice or documenting a justified locale restriction, which conflicts with the file's language/locale policy requirements.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The external_uncontrolled_copies list contains hardcoded Chinese-language strings in the command output. This forces a specific locale in user-facing output without opt-in or clear region-specific justification, making it a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This markdown file contains user-facing operational instructions exclusively in Chinese, including the contract, budget, and interview flow. Under the policy rule, forcing a specific language without explicit opt-in or a documented region-specific justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This markdown file presents the operational instructions entirely in Chinese, including core behavior and constraints, but does not indicate that the user can choose another language. That creates a natural-language policy issue if users are expected to consume the skill in a language they did not opt into.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The schema makes subject.preferred_languages mandatory for every personal context record, but there is no adjacent field indicating whether the user voluntarily supplied this attribute, wants it stored, or is declining to answer. In a skill explicitly designed to build long-lived personal context, forcing collection of profile attributes increases privacy risk and can pressure over-collection of personal data beyond what is necessary for the task.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The entire skill is written in Chinese and provides operational instructions only in that language. There is no indication that the user can opt into another language or that the skill is intentionally limited to a Chinese-speaking or region-specific context, which creates a natural-language policy concern under the language/locale rule.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The entire operational manual is written in Chinese and does not indicate that language selection is optional or configurable. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the constraint is explicitly justified.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Confidence
50% confidence
Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · context_store.py (reported line 1184)May include surrounding context.

python
def audience_from_args(args: argparse.Namespace, principal: Dict[str, str]) -> List[Dict[str, str]]:
    values: List[str] = []
    for key in ("audience_id", "audience_ids", "audience"):
        value = getattr(args, key, None)
        if isinstance(value, list):
            values.extend(value)
        elif isinstance(value, str) and value:

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Confidence
50% confidence
Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · context_store.py (reported line 2110)May include surrounding context.

python
def purge_target_from_args(args: argparse.Namespace) -> Tuple[str, str]:
    provided = [(kind, getattr(args, f"{kind}_id", None)) for kind in sorted(PURGE_KINDS) if getattr(args, f"{kind}_id", None)]
    if len(provided) != 1:
        raise StoreError("Provide exactly one of --claim-id, --source-id, --view-id, or --patch-id")
    kind, target_id = provided[0]