ClawHub
Back to skill

Security audit

Build

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent build automation, but it can make persistent code changes, install repository hooks, commit automatically, and continue across phases from broad trigger phrases.

Install only if you want an agent to autonomously execute existing plan tasks, run local build/test/lint commands, modify files, install repo hooks, and create git commits. Prefer invoking it explicitly with a track or task, and review the repository state before and after runs.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Tool Parameter Abuse

High
Category
Tool Misuse
Content
```
Then update plan.md: all tasks in that phase `[x]` → `[ ]`.

**Never use `git reset --hard`** — always `git revert` to preserve history.

## Progress Tracking (TodoWrite)
Confidence
65% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Vague Triggers

Medium
Confidence
95% confidence
Finding
The trigger phrases are overly broad and map common conversational language like 'build it' and 'ship it' to a high-impact autonomous execution skill. In context, this skill can edit files, run shell commands, install hooks, and commit to git, so accidental activation could cause unintended code changes or command execution without sufficiently explicit user intent.

Intent-Code Divergence

Medium
Confidence
92% confidence
Finding
Line L016 says the skill is 'self-contained' and should follow its own loop instead of delegating to external skills, but the skill explicitly authorizes and recommends external MCP tools such as web search and Context7 docs lookup at L010 and L026-L032. That is an active contradiction in the documented operating model, not just an omitted detail.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
Revert this phase: git revert abc1234..HEAD
```

Proceed to the next phase automatically. No approval needed.

## Error Handling
Confidence
88% confidence
Finding
The skill authorizes itself to proceed through phases automatically with 'No approval needed' after making code changes, running commands, and creating commits. In an execution skill with Bash, Write, Edit, and git capabilities, reducing human checkpoints increases the chance of unintended or unsafe changes being applied broadly before a user can intervene.

Intent-Code Divergence

Low
Confidence
78% confidence
Finding
L039 states 'only docs/plan/' and 'DO NOT search for conductor/ or any other directory,' but the immediately following startup steps instruct loading docs/workflow.md, stack YAML, CLAUDE.md, and .solo pipeline state from other paths at L041-L050 and L095-L100. This creates contradictory operator guidance about what directories may be accessed during initial setup.

Static analysis

No suspicious patterns detected.