ClawHub
Back to skill

Security audit

Auto

Security checks for vulnerabilities and agentic risk

Overview

ClawScan judged this skill benign with high confidence: the scanners reported broad activation and autonomy concerns, but the verdict treats the flagged patterns as expected in context, and the AIG scan found no results.

The verdict is benign, but it is not a guarantee of zero risk. Consider whether you want a skill that may activate for broad requests without an explicit invocation, and review its instructions before installing if that activation scope matters to you.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SKILL.md (reported line 154)May include surrounding context.

md
tool, verify the remote agent's identity, protocol, authentication and task
capabilities, and use its supported status/cancellation flow. If none exists,
report that protocol support is unavailable and use supported proposal handoffs
where helpful. Do not invent endpoints, advertise full A2A compatibility, send
context to an unrelated agent, or give a worker broader access than the task.

## Credentials and approvals

The activation description includes broad, everyday assistance contexts without clear scope boundaries.

Medium
Category
Trigger Abuse
Confidence
96% confidence
Finding

Triggers such as "prompt and response improvement," "repeated preferences," and "concise resumable context" apply to many ordinary assistant interactions, not just explicit Auto or connected-app requests. The description provides no exclusions or narrow activation context, allowing unintended selection of this autonomous workflow.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md
# Auto

Finish the user's authorized objective. Reuse prior authorization for the same task and account. Continue necessary reversible work without asking whether to continue. Verify results before reporting completion.

## Discover suitable tools

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.

md
Use the brief to select the smallest sufficient set of connected tools. Perform
dependent actions in order, group independent reads when supported, check actual
results and repair bounded transient failures. Do not replay a write after an
ambiguous timeout without checking whether it already succeeded. Stop retrying
an authorization denial and continue independent work. After verification,
report the outcome, evidence, remaining limits and next necessary action in
plain language. Match requested length and explain technical details only when

Implicit invocation is enabled without a sufficiently specific activation scope.

Medium
Category
Trigger Abuse
Confidence
94% confidence
Finding

The description covers generic autonomous tasks and tool discovery, while allow_implicit_invocation: true permits activation without the explicit $auto invocation. No domain constraints or exclusion conditions distinguish intended requests from ordinary tasks, creating an ambiguous activation boundary.

Content

No source excerpt is available for this finding.