ClawHub
Back to skill

Security audit

ia-brainstorming

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent brainstorming workflow skill that reads relevant project context, asks clarification questions, and may write a design document, with approval boundaries stated for handoff, commits, and headless use.

Install this if you want an agent to help clarify vague feature ideas and produce design notes. Expect it to read relevant project context and possibly create a docs/brainstorms design file; only allow commits or headless execution when you have clearly delegated that authority.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SPEC.md (reported line 16)May include surrounding context.

md
Out of scope:
- Acting as the runtime instructions themselves (those live in `SKILL.md`).
- Trigger phrasings already covered by adjacent `ia-*` skills (`validate-plugin` flags >70% description overlap as DUPLICATE_TRIGGER).
- <!-- to fill in: domain-specific exclusions when the skill drifts -->

## Trigger Context

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
85% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · references/deep-interview.md (reported line 44)May include surrounding context.

md
Before exiting Phase 1, mentally combine what the user has stated so far. If stated-A + stated-B + agent-default-C produces a downstream effect the user is unlikely to have tracked (e.g., "if mute lives on the rule AND we don't warn on delete, rule-delete silently loses pause state"), fire one open probe per genuine combination. Phase 2.5's call-outs are a safety net for residuals, *not* a punt list for consequences you should have surfaced here.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file says it should be used when requirements need dialogue or approach comparison, but it does not define concrete trigger boundaries or exclusion criteria. In an agent setting, vague invocation rules can cause the skill to activate in the wrong contexts, leading the agent to read files, inspect recent commits, and steer decision-making outside the user’s intended scope, which can expand access and create prompt-routing confusion.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/scope-synthesis.md (reported line 29)May include surrounding context.

md
**Path A vs Path B gate.** Routing depends on TWO signals: (1) did any *blocking* question fire before Phase 2.5? AND (2) what tier did Phase 0 classify? Blocking questions = scope disambiguation, dialogue probes, approach selection menus. Internal classification and pressure-tests do not count.

- **Path A**: Lightweight tier AND no blocking questions fired → announce-mode. Emit "What we're building" prose only (no other sections, no confirmation question), then proceed to Phase 3 doc-write in the same turn. Lightweight Path A docs are short; post-hoc revision is cheap.
- **Path B**: Standard/Deep tier OR any blocking question fired → full synthesis with confirmation gate. Two scenarios fire Path B: the user invested answer-time in dialogue, or pre-loaded substantive scope content. Either way, the substance earns a real checkpoint. The tier guard catches pre-loaded Deep brainstorms that would otherwise shortcut via the no-questions branch.

**Keep tests per section.** Each conditional section has its own keep test; failing items dissolve into the internal draft only.

Static analysis

No suspicious patterns detected.