ClawHub
Back to skill

Security audit

ML Evolution Agent

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a Kaggle training template, but it is packaged and described as an autonomous self-improving ML agent that the artifacts do not actually implement.

Install only if you want a Kaggle-style baseline template, not a finished autonomous ML agent. Review the Python script before running it, use non-sensitive datasets unless you have approved local processing, ensure ./submissions is intended for outputs, and do not uncomment the Kaggle submit command unless you explicitly want to submit with your Kaggle credentials.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The declared description promises an autonomous, self-improving ML competition agent with accumulated memory and iterative evolution inspired by a specific methodology. The supplied code does not implement any of those core behaviors. It is a conventional single-run baseline training template: it reads local CSV files, engineers target statistics, trains three gradient-boosting models with cross-validation, blends outputs, and writes a submission CSV. There is no persistence of experiment history, no memory system, no adaptation based on prior runs, no experiment loop, and no mechanism to continuously improve leaderboard scores. While the code is related to ML competitions in general, its actual purpose is materially narrower and different from the declared autonomous evolving agent behavior.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding

The skill advertises shell-capable behavior via installation/runtime requirements and references to runnable scripts, but it does not declare an explicit tool scope such as permissions or allowed-tools. In an agent platform, that ambiguity can cause the skill to be invoked with broader execution capability than users or orchestrators expect, increasing the chance of unintended command execution or unsafe environment access.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger conditions are broad enough that the skill could activate for many generic ML or Kaggle-related requests without clear boundaries on task type, data sensitivity, or execution mode. Over-broad activation increases the risk of the skill being applied in inappropriate contexts, potentially leading to unnecessary code execution, accidental use on sensitive datasets, or user confusion about what actions will be taken.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

This code performs a filesystem write by creating a timestamped submission file, but there is no explicit user confirmation or warning beyond a post-action success message. For a template script, users may not realize running it will create artifacts under the local submissions directory.

Content

No source excerpt is available for this finding.