ClawHub
Back to skill

Security audit

Alone Time Architect

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward solitude-planning helper with no evidence of hidden access, persistence, exfiltration, or unsafe automation.

This appears safe to install for personal planning use. Be aware that malformed or unexpected purpose values may cause the skill to fail instead of returning a graceful response, so the publisher should harden input validation.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Note
Location
handler.py:131
Finding

Unvalidated Purpose Value Causes Unhandled KeyError and Request Denial of Service

Content
View full analysis
str: return { 'Rest': 'A quiet room, shaded bench, or another low-stimulation place', 'Clarity': 'A walkable route or a table with a notebook and no chatter', 'Play': 'A light, low-pressure place that feels a little fresh', 'Recovery': 'A protected, gentle space where you do not need to perform', 'Creative space': 'A desk, library table, studio corner, or café with minimal interruption', }[purpose] def _activity_palette(purpose: str) -> Tuple[str, str, str]: palettes = { 'Rest': ( 'Tea, stretching, closed-eye rest, or lying down without input', 'A slow walk or a few pages of quiet reading without multitasking', 'Ten minutes of silence and breathing before writing one simple line about what you need', ), 'Clarity': ( 'A brain-dump list of everything crowding your mind', 'A solo walk with one question and no podcast', 'Sit with one notebook page and ask what matters most right now', ), 'Play': ( 'Flip through an art book, playlist, or playful prompt', 'Sketch, doodle, wander, or make something with no outcome pressure', 'Let yourself explore one small curiosity without turning it into a project', ), 'Recovery': ( 'Warm tea, gentle stretching, or sitting somewhere soft and quiet', 'A slow walk, soothing music, or a very light tidy reset', 'A full protected block with no obligation except settling your nervous system', ), 'Creative space': ( 'Freewrite or sketch fragments without judging them', 'Read a few pages, collect notes, o ...[truncated 3234 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
80% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · handler.py (reported line 124)May include surrounding context.

python
'A full protected block with no obligation except settling your nervous system',
        ),
        'Creative space': (
            'Freewrite or sketch fragments without judging them',
            'Read a few pages, collect notes, or outline one idea thread',
            'One uninterrupted making block with the phone out of reach',
        ),

Static analysis

No suspicious patterns detected.