ClawHub
Back to skill

Security audit

grill

Security checks for vulnerabilities and agentic risk

Overview

This skill’s draft-editing instructions and local text scanner fit its stated purpose, with no evidence of hidden or harmful behavior.

Use this on drafts you select. Matching draft lines appear in agent output, and fact-checking may involve web searches. Review the separate plate skill before using its required leak-check step; it is not included in this package.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Incomplete referenced artifact analysis

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md
2. **Slop: strip the AI tells and empty hedges.** Run `scripts/grill-scan.sh <file>` for the mechanical hits (slop vocabulary, hedge phrases, em dashes, the rhy