ClawHub
Back to skill

Security audit

Agent Optimizer.Skip

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate local agent-optimization skill, but it persistently stores raw agent task/output data and does not safely constrain file paths.

Review before installing. Use only simple trusted agent IDs, avoid logging secrets or regulated data, add path validation and redaction, and set a clear retention or cleanup process for trajectory, reward, report, and prompt files.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Context-Inappropriate Capability

Medium
Confidence
98% confidence
Finding
The script interpolates the user-controlled agent_id directly into filesystem paths for both reads and writes under /workspace/subagents/{agent_id}/..., with no validation or normalization. An attacker can supply path traversal sequences such as ../ to escape the intended directory and read or overwrite arbitrary files accessible to the process, which is especially risky because the code writes a JSON report to the derived path.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill advertises automatic recording of agent inputs, outputs, and tool-call details before presenting any prominent consent, minimization, or warning language. In this context, agent traces can easily contain prompts, secrets, user content, or internal tool results, so silent collection materially increases privacy and compliance risk.

Ssd 3

Medium
Confidence
97% confidence
Finding
The design explicitly stores full task and output content in plain files for later analysis. Because agent tasks and outputs often include sensitive user data, prompts, credentials, internal documents, or tool responses, this creates a durable plaintext data store that can be exposed through local compromise, backups, debugging, or later reuse.

Ssd 3

Medium
Confidence
98% confidence
Finding
The example implementation writes raw task and output objects directly into trajectories.jsonl without sanitization or filtering. In a skill specifically meant to optimize agent behavior, this context makes the issue more dangerous because collection is persistent, routine, and likely to aggregate large volumes of natural-language and structured sensitive data over time.

Static analysis

No suspicious patterns detected.