ClawHub
Back to skill

Security audit

Hid Dock

Security checks for vulnerabilities and agentic risk

Overview

The skill is scoped to a specific Windows HID dock, but it downloads and runs an unverified Windows executable from GitHub, so users should review it before installing.

Install only if you trust the publisher and the specific GitHub release. Prefer a version with a published SHA-256 checksum or code signature, and understand that hid-dock.exe will run as your Windows user and can interact with the target HID device.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:7
Finding

Unverified Remote Executable Download and Immediate Execution

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 1)May include surrounding context.

md
---
name: hid-dock
description: "Connect to and control the Acasis Flow HID dock hardware (VID=0x35e6 PID=0xa4ac, 64-byte reports). Use when: the user asks to connect, check, switch view/page, read from, or send to the HID dock / 扩展坞 / Flow View device. Switches the dock screen between 数据同步(dataSync) and 快捷操作(shortcuts), inspects connection, reads reports, and sends raw payloads. Windows only. NOT for: generic mouse/keyboard automation or other vendors' HID devices."
metadata: