ClawHub
Back to skill

Security audit

Compound docs

Security checks for vulnerabilities and agentic risk

Overview

This skill is a documented troubleshooting-knowledge workflow, but its broad auto-trigger can create or modify repository documentation after ordinary success phrases without an explicit write-approval checkpoint.

Install only if you want automatic solution-capture behavior. Before using it, narrow the trigger to explicit requests such as 'document this solution' or require the agent to show the target path and wait for approval before creating or changing files, especially before using the options that modify or create skills.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (11)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The description focuses on authoring or recording resolved-issue documentation and institutional knowledge. The code does not create, summarize, or store documentation content; instead, it validates the metadata/frontmatter of an existing Markdown document against a schema. This is related to documentation workflows, but the primary purpose is materially different: schema validation/quality enforcement rather than documenting solved problems. No suspicious extra permissions are present, but the implemented capability is narrower and different enough to constitute a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The declared purpose describes a skill for documenting resolved issues and building a reusable knowledge base. The actual code shown only executes a Python validator script for frontmatter. That behavior is materially different from the declared primary purpose and suggests metadata validation functionality, which is undeclared. While this could be a supporting utility inside a larger documentation skill, based solely on the supplied code chunk the behavior does not accurately represent the stated documentation-focused purpose.

Content

No source excerpt is available for this finding.

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SPEC.md (reported line 16)May include surrounding context.

md
Out of scope:
- Acting as the runtime instructions themselves (those live in `SKILL.md`).
- Trigger phrasings already covered by adjacent `ia-*` skills (`validate-plugin` flags >70% description overlap as DUPLICATE_TRIGGER).
- <!-- to fill in: domain-specific exclusions when the skill drifts -->

## Trigger Context

Vague Triggers

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The example explicitly says the skill auto-invokes on a common conversational phrase, "That worked!", which is likely to appear in ordinary chat. In an agent setting, this can cause unintended activation and downstream actions such as collecting context and preparing repository changes without an explicit user request to document anything.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding

The skill directs the agent to read local files and reference scripts/templates, but it does not declare an explicit tool scope such as permissions or allowed-tools. In an agent environment, undeclared file access expands ambiguity around what the skill may read and can lead to overbroad repository access or accidental data exposure.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The auto-invocation trigger uses common conversational phrases like 'that worked' or 'it's fixed', which can be said in many contexts unrelated to documentation capture. In an agent workflow, this can cause unintended activation, leading to unnecessary file searches, draft creation, validation runs, or writes that the user did not explicitly request.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The auto-invocation phrases are common conversational confirmations like 'that worked' and 'it's fixed', so the skill may trigger during ordinary dialogue without the user intending to start a documentation workflow. Because the workflow later performs searches and repository writes, broad triggers raise the risk of unintended actions from routine chat context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The process includes creating directories, writing new documentation files, and appending cross-references, but it does not require a user-facing warning that repository files will be modified. In a conversational agent setting, silent write behavior is risky because users may interpret the workflow as advisory rather than as permission to mutate the workspace.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill’s stated purpose is documenting solved problems, but Option 5 expands scope into creating a new skill, which is a higher-impact repository modification path not justified by the documentation workflow. This creates capability creep: a user invoking a docs helper could be steered into generating new automation artifacts, increasing the chance of unintended codebase changes or persistence of unsafe logic.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The scenario describes creating a file in the repository as part of the skill flow, but does not show any user warning or explicit confirmation before modifying project contents. This is dangerous because users may believe they are only discussing a resolved issue, while the agent proceeds to persist artifacts in the repo and potentially alter team knowledge sources.

Content

No source excerpt is available for this finding.

Insecure deserialization: yaml.load() with an unsafe Loader

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

Untrusted data is passed to an insecure deserializer (pickle, marshal, dill, jsonpickle, joblib, yaml.load without a safe Loader, or torch.load without weights_only). These deserializers reconstruct arbitrary objects and invoke callables during loading, so deserializing attacker-controlled bytes is equivalent to arbitrary code execution.

Content

Scanner excerpt · scripts/validate-frontmatter.py (reported line 59)May include surrounding context.

python
end = lines.index("---", 1)
        except ValueError:
            raise ValueError("Missing closing --- delimiter") from None
        data = yaml.load("\n".join(lines[1:end]), Loader=FrontmatterLoader)
        if not isinstance(data, dict):
            raise ValueError("Frontmatter must be a YAML mapping")
    except (OSError, UnicodeError, ValueError, yaml.YAMLError) as error:

Static analysis

No suspicious patterns detected.