Security audit

Canning Food Preservation

Security checks for vulnerabilities and agentic risk

Overview

The skill is useful in concept, but it needs review because it gives safety-critical canning guidance with overbroad formulas and under-discloses external reminders, updates, and persistence.

Review carefully before installing. Use only authoritative, current USDA/NCHFP tested recipes for exact food type, jar size, pack method, canner type, gauge type, and altitude; do not rely on this skill's generalized pressure or timing formulas. Also confirm where files will be written and avoid enabling email or external reminders unless the channel and shared inventory details are explicit.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:15
Finding: Unpinned npm Package Execution During Installation
Content: View full analysis
Remediation: View remediation

other

Error

Location: SKILL.md:67
Finding: Unsafe Generalized Pressure and Timing Rules for Home Canning
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The skill instructs users to run npx clawhub install canning-food-preservation without pinning a specific version or integrity-checked artifact. That creates a supply-chain risk: a malicious or compromised upstream package could change behavior at install time and execute unexpected code in the user's environment.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: This is a second unpinned npx clawhub invocation in the skill body, duplicating the same supply-chain exposure. Repeating the unsafe install command increases the chance users will execute an unverified package and trust dynamic remote content.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest declares filesystem-only tooling, but the skill text describes sending reminders through external channels and pulling guideline updates from outside sources. This capability mismatch can mislead reviewers and users about actual data flows and permissions, undermining trust boundaries and enabling unintended exfiltration or network-dependent behavior.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: Routing to emergency-food-triage or a crisis protocol extends the skill beyond canning assistance into emergency-response orchestration. Cross-skill escalation outside the declared scope can create unsafe or privacy-sensitive handoffs, especially if downstream skills have broader permissions or make high-stakes recommendations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The skill states that the agent creates /canning-batch-[YYYYMMDD] and writes multiple files without clearly indicating a user confirmation step at the moment of write. Even with filesystem-only permissions, silent persistence can surprise users, create unwanted local data retention, or overwrite existing content if naming collisions occur.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 75% confidence
Finding: The reminder email template implies data may be transmitted through an external channel, but the skill does not clearly warn users about privacy implications at the point of use. Inventory details, dates, and household consumption patterns can reveal behavioral information if sent through third-party messaging systems.
Content: No source excerpt is available for this finding.