ClawHub
Back to skill

Security audit

AI KEY·拿不准的时候

Security checks for vulnerabilities and agentic risk

Overview

ClawScan marks this skill suspicious because it reports that the skill stores observations about user behavior without a privacy notice or approval; the scan was partial, so evidence is incomplete.

Review the skill’s memory and privacy practices before installing. Consider whether you are comfortable with it retaining behavior and decision observations, and note that a local reference was missing, leaving the scan incomplete.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

The skill instructs the agent to persist user-specific behavioral observations without a user-facing privacy notice.

Medium
Category
Output Handling
Confidence
93% confidence
Finding

The skill explicitly directs persistent storage of recurring user behavior, decision outcomes, and reasons for stalled tasks without requiring a privacy notice or user approval. These records may reveal sensitive business information and personal or psychological inferences, creating exposure if the memory store is later accessed or reused outside the expected context. Persistence supports the skill’s legitimate coaching purpose, and no external transmission is shown, but that does not address the missing consent, retention, and access boundaries.

Content

No source excerpt is available for this finding.