ClawHub
Back to skill

Security audit

ia-debugging

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent debugging skill with disclosed local diagnostics and no hidden install or persistence behavior, but users should review diagnostic output before sharing it.

Install only if you want the agent to follow a structured debugging workflow. Treat generated diagnostics and probe output as sensitive, review and redact paths, usernames, repository URLs, branch names, commit subjects, environment values, customer data, and credentials before sharing them outside the workspace. Prefer existing project test commands over ad hoc unpinned npx commands when available.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (8)

Tp4

High
Category
MCP Tool Poisoning
Confidence
86% confidence
Finding

The declared description suggests an active debugging/root-cause analysis capability for failures, tests, regressions, and verification workflows. The code does not analyze failures, reproduce bugs, inspect stack traces, run tests, or verify hypotheses. Instead, it gathers contextual diagnostics about the host and repository. While such diagnostics can support debugging, the implemented behavior is materially narrower and different in primary purpose. It also accesses local system information, git metadata, and selected environment values without those capabilities being reflected in the declared description.

Content

No source excerpt is available for this finding.

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SPEC.md (reported line 16)May include surrounding context.

md
Out of scope:
- Acting as the runtime instructions themselves (those live in `SKILL.md`).
- Trigger phrasings already covered by adjacent `ia-*` skills (`validate-plugin` flags >70% description overlap as DUPLICATE_TRIGGER).
- <!-- to fill in: domain-specific exclusions when the skill drifts -->

## Trigger Context

Context Leakage

High
Category
Data Exfiltration
Confidence
75% confidence
Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · references/defense-in-depth.md (reported line 74)May include surrounding context.

Layer 4: Debug Instrumentation

Capture context for forensics when the other layers fail.

typescript
async function gitInit(directory: string) {

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill description says to use it for 'errors, stack traces, broken tests, flaky tests, regressions, or anything not working as expected.' The phrase 'anything not working as expected' is very broad and overlaps with everyday debugging/help requests, without explicit exclusions or negative examples to constrain when this skill should activate.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The listed should-trigger examples include generic requests like "help me debug this failing test" and "why is this function failing," which overlap with ordinary troubleshooting language a user might use without intending to invoke this specific skill. Although negative examples are present, the positive trigger scope remains broad for a discipline-class skill and does not clearly constrain when this skill should activate versus adjacent debugging or coding workflows.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The guidance explicitly recommends collecting system information, project files, git state, and environment variables, and even attaching the output to bug reports, but it provides no warning to review or redact secrets first. Environment variables and project files commonly contain API keys, tokens, credentials, internal URLs, customer data, or proprietary source, so following this advice can cause accidental sensitive-data exfiltration to tickets, logs, or third-party systems.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/specialized-patterns.md (reported line 124)May include surrounding context.

md
Watch for these signs from the user; they indicate you've left the systematic process:

- "Is that not happening?": you assumed behavior without checking
- "Will it show us...?": you're not gathering enough evidence
- "Stop guessing": you're proposing fixes without root cause
- "We're going in circles": same hypothesis repackaged, not a new approach