ClawHub
Back to skill

Security audit

Retirement

Security checks for vulnerabilities and agentic risk

Overview

This is a markdown-only retirement planning skill with purpose-aligned financial guidance and no executable code, persistence, or hidden system behavior.

Use this for educational retirement planning and scenario modeling, but keep inputs minimized and generalized where possible. Do not provide account numbers, tax IDs, login credentials, or full sensitive documents, and consult a licensed financial or tax professional before acting on personalized advice.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill explicitly invites users to provide highly sensitive financial, tax, health, and family-history data to personalize retirement calculations, but it provides no privacy warning, minimization guidance, or handling constraints. In a financial-planning context, this increases the likelihood that users overshare regulated or high-value personal data that could be exposed, retained, or misused by downstream systems.

Vague Triggers

Low
Confidence
83% confidence
Finding
This markdown file describes the skill's purpose in very broad terms but does not define specific trigger phrases, activation conditions, or exclusions. That ambiguity could cause unintended invocation for general financial conversations related to saving, taxes, or life planning.

Static analysis

No suspicious patterns detected.