ClawHub
Back to skill

Security audit

Thinking Framework

Security checks for vulnerabilities and agentic risk

Overview

This is a Markdown-only thinking-framework skill with sensitive psychological analysis, but its behavior is disclosed, bounded, and does not install code, access files, or persist beyond the chat.

Install only if you want an analytical framework that may make speculative psychological inferences. Use it for public, well-documented figures or philosophies, treat psychological outputs as uncertain interpretation, and avoid using it to judge private people, diagnose anyone, or make high-stakes decisions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Vague Triggers

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The trigger conditions are extremely broad and include common phrases like "X mode" or naming a public figure plus a request to apply their approach, which can cause the skill to activate in contexts the user did not intend. Because the skill then applies a deep psychological and behavioral reasoning lens, accidental invocation can lead to unauthorized profiling, unsafe framing, or policy-bypassing style shifts under ambiguous requests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill advertises mapping a target's "psychological formation," "defense patterns," and "blind spots" without warning users about the sensitivity and uncertainty of psychological profiling, especially for real or living people. In context, this increases the risk of users eliciting speculative mental-health-style inferences presented as analysis, which can be misleading, invasive, or harmful even if the skill later contains internal guardrails.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This file instructs the agent to perform deep psychological profiling of identifiable people by inferring wounds, attachment style, defenses, shadow traits, and breakdown patterns from public evidence, but it lacks a strong safety warning or limiting guidance about sensitivity, uncertainty, and misuse. In a skill explicitly designed to 'load' a person's mental operating system and apply it as a reasoning lens, this materially increases the risk of harmful mental-health-adjacent inference, defamation, manipulative targeting, and overconfident pseudo-diagnostic outputs.

Content

No source excerpt is available for this finding.

YARA rule 'network_reconnaissance': Network reconnaissance and scanning patterns [hacktools]

Medium
Category
YARA Match
Confidence
65% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · references/layer2-psychological.md (reported line 39)May include surrounding context.

sessed with visibility often came from being unseen; people obsessed with certainty often came from instability) 3. Find what makes them disproportionately reactive — that's where the wound lives 4. Identify the early relationship patterns (family structure, key figures, major losses) where these patterns were first formed

Common wound archetypes:

text
Abandonment        : Drives fierce independence, self-sufficiency, distrust of reliance.
                     Often manifests as preemptive emotional withdrawal.
Invisibility       : Drives compulsive need for recognition, legacy, proof of impact.
                     The work is never enough because the wound is about being seen.
Inadequacy         : Drives perfectionism, overachievement, deep fear of exposure.
                     Impostor syndrome is the wound's voice.
Chaos / Instability: Drives need for control, systems, order, predictability.
                     The tighter the system, the worse the original chaos

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This guidance explicitly instructs the model to emit step-by-step chain-of-thought in its response, which can expose hidden reasoning that should remain internal. Revealing detailed internal reasoning increases prompt-injection surface, can leak policy-avoidance strategies or unsafe intermediate inferences, and is unnecessary for this skill’s stated purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The document tells the model to provide explicit reasoning steps in the response, effectively requesting disclosure of internal deliberation. In a skill centered on psychological and cognitive modeling, those verbose intermediate steps can amplify hallucinated inferences, reveal unsafe internal logic, and make downstream prompt manipulation easier.

Content

No source excerpt is available for this finding.

Ssd 2

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The file specifically instructs weaker models to reveal step-by-step internal reasoning to compensate for lower capability. That is dangerous because weaker models are already more prone to hallucination and prompt-following errors, so forcing them to externalize reasoning increases the chance of leaking unreliable or manipulable intermediate thoughts.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
75% confidence
Finding

This section is framed as model guidance for weaker/local models, but the instruction says 'At the start of every response in framework mode,' which broadens it into a universal runtime behavior rather than a limited compensation. That documentation intent is narrower than the operational instruction it gives.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.