ClawHub
Back to skill

Security audit

SIAS Self-Improving Agent System Research

Security checks for vulnerabilities and agentic risk

Overview

This research skill is mostly coherent, but it can persist investigative data and instructs agents to send critical findings to a fixed Telegram recipient without a user consent step.

Install only if this is your SIAS/Rheingold environment and the Iggy Telegram recipient is intended. Before use, disable or rewrite the Telegram notification rule, restrict database permissions to the listed tables, and decide retention/deletion rules for findings, mail contents, and personal data.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill explicitly requires that all research results be stored in the database, but it does not warn users that submitted content, research notes, or potentially sensitive personal data may be persisted. In an investigative workflow involving NGOs, people, authorities, and mail contents, this creates a real risk of silent retention of sensitive or regulated data beyond user expectations.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill instructs sending critical findings to Telegram without any warning, consent flow, or restriction on what data may be transmitted. Because Telegram is an external service, this can expose sensitive investigative details, personal data, or confidential government correspondence to a third party and create compliance and confidentiality risks.

Static analysis

No suspicious patterns detected.