Security audit

Find trending skills

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward ClawHub trend monitor that uses disclosed network fetches and local state files, with optional scheduling that users must set up themselves.

Install only if you are comfortable with the skill fetching public ClawHub data and keeping local state under ~/.skill-surge-notifier. Do not put secrets or sensitive project details in the profile description or keywords. If you add the suggested cron entry, review it as a persistent scheduled task and remove it when you no longer want automatic checks.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Rogue AgentSelf-Modification, Session Persistence
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill documents executable commands that use Node.js, network access, and environment-variable-controlled paths, but it does not declare any explicit tool scope or permissions. In an agent ecosystem, this weakens isolation and reviewability because the runtime capabilities exceed what the manifest communicates, increasing the chance of unintended network use or filesystem access under agent execution.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

State is stored in ~/.skill-surge-notifier/state.json. The first run seeds the baseline; growth % appears from the second run onward.

All output is printed to stdout. When used inside an agent, the agent must capture the CLI output to surface alerts in chat.

To run automatically, add to crontab (crontab -e):

bash
0 */4 * * * node {baseDir}/cli.js check >> ~/.skill-surge-notifier/surge.log 2>&1

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The markdown states that profile information is 'stored locally in ~/.skill-surge-notifier/' but does not provide any warning that an agent description and keywords may contain sensitive operational details. For markdown files, SQP-2 applies when descriptions omit warnings about behaviors that could affect user data or privacy.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The profile set command persists a free-form agent description and keywords to storage via saveProfile(...), but the CLI output does not clearly warn users that this potentially sensitive data will be saved locally and retained. While this is not code execution or privilege escalation, it creates a privacy risk because users may enter confidential workflow details, internal project names, or other sensitive metadata without understanding it will be stored.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The code persists state and configuration data using writeFileSync at L27 and L37, but there is no confirmation prompt, log message, or explanatory comment/docstring indicating that local files will be created or overwritten. Because this file performs file writes, it falls under the missing-warning check for code files.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The comment says the file can be run directly via this module, but the guard checks for a path ending in "surge_check.ts" while the analyzed file is "surge_check.js". As written, the documented direct-run behavior does not match what the code will actually do in this file.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: fetch_trending.js:21