ClawHub
Back to skill

Security audit

Play Rediscovery Guide

Security checks for vulnerabilities and agentic risk

Overview

This is a low-risk self-reflection skill for helping adults rediscover play, with no code execution, credential access, persistence, or hidden data handling.

Installers should treat this as a self-reflection and hobby-discovery aid, not therapy or professional mental-health advice. Non-Chinese users may find parts of the README and examples less accessible, but the package does not show security-sensitive behavior.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The README content is entirely in Chinese and demonstrates only Chinese-language interactions, which can steer the agent to respond in Chinese without checking the user's preferred language. This is a policy/UX safety issue because it can reduce user comprehension, informed consent, and accessibility, especially if the user expects another language and receives guidance they may misunderstand.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The 'Use when...' description includes very general conditions such as feeling life is too serious, wanting more presence, or feeling creativity has become productivity-driven. These are common life situations and the file does not define specific invocation phrases, scope constraints, or exclusion examples, which makes unintended activation more likely.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

Several usage scenarios and expected outputs are written in Chinese, while the rest of the document is in English. This can imply a locale or language preference without explicitly stating that users may choose their preferred language, which may conflict with language-neutral organizational policy expectations.

Content

No source excerpt is available for this finding.