ClawHub
Back to skill

Security audit

Agent Designer

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed local toolkit for designing and evaluating agent systems, with the main caution that its generated sample designs should be tightened before real deployment.

Install only if you want a local design and reporting toolkit. Review generated agent/tool schemas before deploying them, especially any code execution, file management, API, notification, document-processing, or scheduling capabilities, and avoid using sensitive logs or secrets as inputs unless the output location and retention are acceptable.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (29)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill is described as a multi-agent architecture designer, but the detected behavior includes generating tool schemas, processing JSON files, and writing multiple output artifacts. That discrepancy can conceal materially different data flows and side effects, making it easier for a user or orchestrator to invoke file-processing and file-writing behavior they did not expect, with risks ranging from unsafe overwrites to covert transformation of supplied data.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The skill is described as a multi-agent architecture designer, but the detected behavior includes generating tool schemas, processing JSON files, and writing multiple output artifacts. That discrepancy can conceal materially different data flows and side effects, making it easier for a user or orchestrator to invoke file-processing and file-writing behavior they did not expect, with risks ranging from unsafe overwrites to covert transformation of supplied data.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill manifest describes 'agent-designer' for multi-agent system architecture, but this file's module docstring explicitly states it performs performance analysis of execution logs and generates evaluation reports and optimization recommendations. The implemented code parses logs, computes metrics, analyzes errors and bottlenecks, and writes reports, which is materially different from designing agent architectures.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The tool description exposes a capability to download remote documents and access local files, but the description does not prominently warn users or downstream agents about those side effects. In an agent-design setting, vague capability descriptions increase the chance that another agent invokes the tool on attacker-influenced paths or URLs without understanding the data-exfiltration and trust-boundary implications.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The notification_sender performs real external side effects, including sending emails, SMS, webhooks, or push messages, but its description does not prominently emphasize that invocations trigger actual outbound communication. In a multi-agent architecture skill, insufficient warning makes accidental spam, data leakage to third parties, phishing-style misuse, or unauthorized notifications more likely.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · tool_schema_generator.py (reported line 303)May include surrounding context.

python
if format_name in self.format_validators:
                rules.update(self.format_validators[format_name])
        
        return rules
    
    def _generate_string_validation(self, param_spec: Dict[str, Any]) -> Dict[str, Any]:
        """Generate string-specific validation rules"""

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · tool_schema_generator.py (reported line 341)May include surrounding context.

python
if format_name in self.format_validators:
                rules.update(self.format_validators[format_name])
        
        return rules
    
    def _generate_string_validation(self, param_spec: Dict[str, Any]) -> Dict[str, Any]:
        """Generate string-specific validation rules"""

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · tool_schema_generator.py (reported line 368)May include surrounding context.

python
if format_name in self.format_validators:
                rules.update(self.format_validators[format_name])
        
        return rules
    
    def _generate_string_validation(self, param_spec: Dict[str, Any]) -> Dict[str, Any]:
        """Generate string-specific validation rules"""

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · tool_schema_generator.py (reported line 385)May include surrounding context.

python
if format_name in self.format_validators:
                rules.update(self.format_validators[format_name])
        
        return rules
    
    def _generate_string_validation(self, param_spec: Dict[str, Any]) -> Dict[str, Any]:
        """Generate string-specific validation rules"""

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · tool_schema_generator.py (reported line 411)May include surrounding context.

python
if format_name in self.format_validators:
                rules.update(self.format_validators[format_name])
        
        return rules
    
    def _generate_string_validation(self, param_spec: Dict[str, Any]) -> Dict[str, Any]:
        """Generate string-specific validation rules"""

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · tool_schema_generator.py (reported line 434)May include surrounding context.

python
if format_name in self.format_validators:
                rules.update(self.format_validators[format_name])
        
        return rules
    
    def _generate_string_validation(self, param_spec: Dict[str, Any]) -> Dict[str, Any]:
        """Generate string-specific validation rules"""

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
82% confidence
Finding

The skill metadata does not declare an explicit tool scope, yet the analysis indicates capabilities consistent with file read/write and network access. In a powerful agent skill, undeclared capability boundaries undermine least-privilege controls and can allow architectural-design prompts to become a vehicle for broader data access, file modification, or outbound exfiltration if the runtime grants those tools implicitly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The tool serializes analysis outputs derived from execution logs into multiple JSON files without redaction or a clear warning that logs may contain sensitive task descriptions, results, error details, tokens, or metadata. In agent systems, execution logs often contain prompts, secrets, customer data, and internal workflow details, so writing them to disk can create a secondary data exposure channel through local files, backups, shared volumes, or artifact collection.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The planner hard-codes high-risk tools such as code execution, file management, web search, and arbitrary API access into the shared tool catalog, then later assigns them to generated agents without demonstrating requirement-based need or least-privilege controls. In an architecture-design skill, this is dangerous because the output can normalize or propagate unsafe agent designs that include execution and external-access capabilities by default, increasing the chance that downstream systems instantiate over-privileged agents.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The single-agent design assigns all common tools to one agent, and the swarm design gives every peer the full tool set, including code execution and external/external-state access, regardless of requirements. This creates systematic over-privileging and greatly expands blast radius: compromise, prompt injection, or simple misuse of any generated agent would grant broad ability to execute code, modify files, and reach external services.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The language parameter defaults to "en" while offering multiple supported languages, but there is no indication that the user chose English or that the locale restriction is justified. This creates a language policy issue because the tool implicitly prefers one language rather than prompting for or inferring user preference.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The document_processor accepts both arbitrary remote URLs and absolute local file paths via the pattern ^(https?://|file://|/), which creates an unsafe capability boundary. In an agent context, this can enable SSRF, unintended access to sensitive local files, or retrieval of untrusted content unless strong allowlisting and execution-context restrictions exist elsewhere; those controls are not expressed here.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The task_scheduler creates delayed or recurring actions, but the description does not clearly warn that effects may occur later and outside the user's immediate view. In agent systems, deferred execution increases the risk of persistence, surprise side effects, and harder-to-audit misuse if downstream agents schedule tasks from ambiguous or attacker-influenced inputs.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The file_manager tool is defined with a generic 'Manage files and directories' description and an unconstrained 'action' plus arbitrary 'path' input. In a multi-agent architecture, this can enable unsafe file reads/writes, path traversal, or accidental access to sensitive filesystem locations because the architecture does not specify scope limits, allowed operations, or authorization boundaries.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This second file_manager definition repeats the same broad capability pattern for the data_specialist agent, again exposing arbitrary file operations through a minimal schema. Because multiple agents can access shared resources and communicate through the system, duplicate unconstrained file access increases the attack surface and the chance of misuse or data leakage.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The schema enumerates multiple supported languages but sets the default to "en", which makes a specific language the implicit behavior for a general-purpose tool. Under the language/locale policy, this is a violation unless the user is given a language choice or the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The tool serializes input-derived content into multiple JSON files without any explicit consent flow, warning, or option to avoid persistence. If tool descriptions contain proprietary prompts, internal endpoints, credentials accidentally embedded in examples, or other sensitive design data, running the tool can leave recoverable copies on disk in several locations.

Content

No source excerpt is available for this finding.

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · agent_planner.py (reported line 366)May include surrounding context.

python
name=f"swarm_agent_{i+1}",
                role=f"Collaborative Worker #{i+1}",
                archetype=AgentRole.SPECIALIST,
                responsibilities=requirements.tasks,  # All agents can handle all tasks
                capabilities=base_capabilities + [f"specialization_{i%3}"],  # Some specialization
                tools=list(self.common_tools.values()),
                communication_interfaces=["peer_messaging", "broadcast", "consensus_protocol"],

Vague Triggers

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The description "Search the web for information" is generic and does not define trigger boundaries, approved use cases, or exclusions. For a manifest file, this can be considered a vague activation description because it overlaps with many common requests and does not clarify when this tool should or should not be used.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

This JSON file includes natural-language remediation text about credential rotation and token refresh logic. While not executable code, the wording references credential-handling actions in a generic way and could be interpreted as prescriptive operational guidance without any user choice, approval, or localization context. However, because this is an evaluation report rather than an instruction file, the concern is limited.

Content

No source excerpt is available for this finding.