ClawHub
Back to skill

Security audit

Idle Reward Optimizer

Security checks for vulnerabilities and agentic risk

Overview

This skill provides text-only guidance for low-energy micro-actions and does not request sensitive access or perform external actions.

Safe to install for text-only planning help. Users should understand it may activate for broad low-energy or waiting-time productivity requests, but it does not create reminders, automate schedules, access accounts, or modify local data.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The declared description says the skill helps design low-effort, recovery-protective micro-actions for idle or low-energy periods. The code does not implement that domain behavior. Instead, it is a generic skill loader/renderer that reads SKILL.md, parses frontmatter and sections, and outputs a formatted summary card, raw template, or metadata. While it labels the output as descriptive guidance and does not perform external actions, its primary purpose is documentation/template presentation, not generating the specific behavioral coaching described. This is a material purpose mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

This code chunk does not exhibit the declared user-facing functionality. Instead, it is test code for infrastructure around loading SKILL.md metadata and prompt templates and checking handler outputs in different modes ('guide', 'meta', 'prompt'). The primary behavior is development/testing support for skill packaging and rendering, which is materially different from designing gentle idle-time or recovery-friendly micro-actions. No suspicious extra permissions are evident, but the implemented behavior is unrelated to the declared purpose, so this is a mismatch.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The description says to use the skill whenever the user wants gentle gains from waiting windows, transitions, or tired periods, which are very common situations and not tied to specific trigger phrases or exclusions. Because the file does not define narrow activation constraints or negative examples, this could cause the skill to be invoked in overly broad everyday contexts.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The listed conditions include common behaviors such as losing small pockets of time, commuting, transitions, and wanting repeatable systems, all of which are broad enough to match ordinary conversation. The section lacks explicit boundaries or exclusion criteria to distinguish intended invocation from general productivity discussions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.