ClawHub
Back to skill

Security audit

Ai Friendly Architecture Design Skill

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-style architecture guidance skill with a local test runner, and the noted risks are mostly low-impact guidance or documentation issues rather than hidden or unsafe behavior.

Reasonable to install as architecture guidance. Treat the OpenAI/Anthropic install note as optional and use pinned dependencies in an isolated environment if adding real LLM integration. If applying the API guidance, avoid returning stack traces to users or agents; keep detailed diagnostics in protected logs.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Note
Location
README.md:44
Finding

Unpinned and Currently Unnecessary Third-Party Dependency Installation

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
SKILL.md:185
Finding

Agent-Facing Error Guidance May Disclose Internal Stack Traces

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · README.md (reported line 67)May include surrounding context.

md
4. Update `references/evals.md` and `references/test-scenarios.md` for evaluation changes
5. Run evaluation suite: `python eval_runner.py` to verify core tests pass
   - All 5 tests should pass before submitting PR
   - If tests fail, update SKILL.md or test scenarios as needed
6. Submit a Pull Request with description of changes and test results

## Version History

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/test-scenarios.md (reported line 558)May include surrounding context.

md
### Improvement Directions

If tests fail, analyze reasons:
1. Skill content unclear → Update SKILL.md
2. Missing related scenarios → Supplement test scenarios
3. Decision framework incomplete → Optimize Decision Framework
4. Missing anti-pattern recognition → Supplement Common Mistakes

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill appears to rely on file-reading capability via local references such as references/article-summary.md, but it does not declare an explicit tool scope (permissions or allowed-tools). Undeclared capability requirements can cause agents or runtimes to grant broader access than intended or make trust boundaries unclear, which is a security and governance issue even though the document is primarily architectural guidance.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The module docstring and CLI help present '--llm openai' and '--llm anthropic' as operational modes requiring corresponding packages. However, when those flags are used, run_test still calls generate_response and prints that simulated responses are being used because actual LLM integration is not yet implemented.

Content

No source excerpt is available for this finding.

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 345)May include surrounding context.

md
| Rationalization | How It Was Addressed | Evidence From Testing |
|----------------|---------------------|----------------------|
| "Multi-Agent is always better" | Common Mistakes entry + Rationalization Table row | Agents previously recommended Multi-Agent for FAQ; now identify as deterministic |
| "ReAct can handle everything" | Agent Layer table + Common Mistakes + Rationalization Table | Agents previously defaulted to ReAct for all tasks; now use BaseAgent for deterministic workflows |
| "Context Engineering is optional" | Context Engineering section with decision guide + impact data | Agents previously only suggested prompt engineering; now suggest case libraries, hybrid decisions |
| "AI for everything" | Decision Framework Q1 + When NOT to Use + Negation Test N1 | Agents previously accommodated blanket AI adoption; now reject and redirect |
| "Authority override" | Common Mistakes + Rationalization Table + Negation Test N2 | Agents previously complied with bad mandates; now push back with principled alternatives |

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · references/evals.md (reported line 220)May include surrounding context.

md
| Rationalization | How It Was Addressed | Evidence From Testing |
|----------------|---------------------|----------------------|
| "Multi-Agent is always better" | Common Mistakes entry + Rationalization Table row | Agents previously recommended Multi-Agent for FAQ; now identify as deterministic |
| "ReAct can handle everything" | Agent Layer table + Common Mistakes + Rationalization Table | Agents previously defaulted to ReAct for all tasks; now use BaseAgent for deterministic workflows |
| "Context Engineering is optional" | Context Engineering section with decision guide + impact data | Agents previously only suggested prompt engineering; now suggest case libraries, hybrid decisions |
| "AI for everything" | Decision Framework Q1 + When NOT to Use + Negation Test N1 | Agents previously accommodated blanket AI adoption; now reject and redirect |
| "Authority override" | Common Mistakes + Rationalization Table + Negation Test N2 | Agents previously complied with bad mandates; now push back with principled alternatives |

Static analysis

No suspicious patterns detected.