ClawHub
Back to skill

Security audit

spec72-intake

Security checks for vulnerabilities and agentic risk

Overview

This is a small intake-routing skill for a paid Spec72 service; it asks for expected order and project details but does not include code, persistence, or hidden automation.

Before using it, confirm you are comfortable sending the listed intake details to Spec72 and avoid including secrets, private credentials, or unnecessary sensitive repository information in the repo URL or problem description.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The description says to use this skill when a buyer 'just paid' or 'needs the post-pay intake fields,' but it does not define concrete trigger phrases, boundaries, or exclusion cases. This ambiguity could cause the skill to be invoked for generic payment-support conversations or unrelated intake requests.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill instructs collection of personal and transaction data including email, repo URL, handoff owner, and transaction/receipt ID, but provides no privacy notice, minimization guidance, retention limits, or caution about sensitive repository information. In context, this can lead users or agents to transmit identifying and potentially confidential business data to external destinations without informed consent or safe-handling guardrails.

Static analysis

No suspicious patterns detected.