ClawHub
Back to skill

Security audit

Last Minute Travel Doc Pack

Security checks for vulnerabilities and agentic risk

Overview

This is a document-only travel checklist skill with clear privacy boundaries and no code, network, credential, or persistence behavior.

Reasonable to install if you want a travel-document checklist helper. Do not paste sensitive ID numbers into the chat, and verify current entry, transit, carrier, and health rules with official sources before departure.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · ACCEPTANCE.md (reported line 55)May include surrounding context.

md
- **Secrets scan:** No API keys, tokens, passwords, or private identifiers present. Skill explicitly avoids storing passport numbers, national ID numbers, visa numbers, ticket numbers, payment card details, or full birth dates.
- **Executable scan:** No scripts (.sh, .py, .js, .rb), no package files, no build artifacts.
- **Network scan:** No API calls, no HTTP client usage, no webhook URLs, no remote endpoints.
- **Credential scan:** No credential instructions, no .env references, no auth flow.
- **Safety metadata:** document_only, promptOnly, runtime:none, execution:noExec, no_code_execution, no_network, no_credentials, requires_api:false.
- **Encoding:** English-only (ASCII-safe), no CJK, no RTL, no special Unicode.
- **File count:** 3 files (SKILL.md, ACCEPTANCE.md, skill.json), no temp/log/hidden files.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The acceptance file explicitly labels the skill as "English-only" in its safety metadata. A forced language constraint is a natural-language policy concern unless the skill offers a language choice or clearly documents a justified region-specific need, neither of which appears here.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The listed trigger phrases include broad wording such as "help me organize travel papers" and "what should I print for my trip," which could overlap with ordinary travel-planning conversation rather than a clearly bounded skill invocation. The file does not provide negative examples or narrower activation constraints to distinguish when this skill should activate versus a general travel assistant response.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

The acceptance criteria require "English-only prompt-flow content," which imposes a language restriction as a policy choice rather than offering the user a language preference. No opt-in mechanism or region-specific justification is provided elsewhere in the file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest sets "language": "en", which is a natural-language locale constraint. There is no indication elsewhere in the file that users can choose another language or that the English-only restriction is required for a region-specific or compliance reason.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.