ClawHub
Back to skill

Security audit

service-cutover-checklist

Security checks for vulnerabilities and agentic risk

Overview

The skill was rated benign with high confidence: the scanners found no AIG issues, and the persistence-related matches in the checklist were judged expected for its purpose.

The scan covered both listed Markdown components completely, and the scanners reported no AIG findings. The verdict is benign, not a guarantee of zero risk; review the skill’s instructions to confirm its checklist fits your needs before installing.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

md
| Data locations and size | working directory, data folders, database files; `du -sh <path>`, `df -h` |
| Databases | engine and version; for SQLite note any `-wal` and `-shm` files next to the database |
| Containers (if used) | `docker ps --format '{{.Names}} {{.Image}} {{.Ports}}'`, `docker inspect --format '{{json .Mounts}}' <name>`, `docker compose config --services`, `docker compose config --volumes` |
| Scheduled jobs | `systemctl list-timers --all`; `crontab -l -u <user>` for each relevant user; the system-wide cron folder. Read only: record schedule and program path, never create, change, or remove a job, and leave out arguments that could carry credentials |
| Time zone | `timedatectl show -p Timezone`; the time zone the app itself uses (an env name such as `TZ`) |
| DNS | `dig +noall +answer <name>` (record and TTL), `dig +short NS <zone>`; whether a CDN proxy sits in front |
| Inbound callers | webhooks, API clients, IP allowlists at partners that name the old address |

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

md
| Data locations and size | working directory, data folders, database files; `du -sh <path>`, `df -h` |
| Databases | engine and version; for SQLite note any `-wal` and `-shm` files next to the database |
| Containers (if used) | `docker ps --format '{{.Names}} {{.Image}} {{.Ports}}'`, `docker inspect --format '{{json .Mounts}}' <name>`, `docker compose config --services`, `docker compose config --volumes` |
| Scheduled jobs | `systemctl list-timers --all`; `crontab -l -u <user>` for each relevant user; the system-wide cron folder. Read only: record schedule and program path, never create, change, or remove a job, and leave out arguments that could carry credentials |
| Time zone | `timedatectl show -p Timezone`; the time zone the app itself uses (an env name such as `TZ`) |
| DNS | `dig +noall +answer <name>` (record and TTL), `dig +short NS <zone>`; whether a CDN proxy sits in front |
| Inbound callers | webhooks, API clients, IP allowlists at partners that name the old address |