ClawHub
Back to skill

Security audit

MTV Rewind

Security checks for vulnerabilities and agentic risk

Overview

This skill is a simple link-out helper for an MTV-style video player, with minor routing overbreadth but no local code, credential use, persistence, or hidden system access.

Before installing, be aware that the skill may activate for broad video or background-music requests and will promote an external site. It does not need credentials or local system access; treat any future version that asks for those permissions as a meaningful change to review.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
95% confidence
Finding
The skill metadata description includes broad trigger phrases such as 'play MTV' and especially 'put on some videos,' which can match common user requests that are not specifically asking for this site. Over-broad activation can cause the agent to invoke this skill unexpectedly and redirect users to an external web player without sufficient specificity or user intent confirmation.

Vague Triggers

Medium
Confidence
97% confidence
Finding
The 'When to Use' section expands activation to vague phrases like 'I need background vibes' and 'Any request for retro music video content,' which are broad enough to capture many unrelated entertainment requests. In context, this increases the chance of unintended skill routing and unsolicited promotion of a third-party site, even though the skill itself does not request credentials or local system access.

Static analysis

No suspicious patterns detected.