Back to skill

Security audit

ia-planning

Security checks for vulnerabilities and agentic risk

Overview

ClawScan rates this skill benign with medium confidence: most checks are okay, while the partial scan flagged a possible mismatch between its stated planning purpose and evaluation commands.

The verdict is benign, but confidence is medium and the scan was partial: a local path-like reference was unresolved, and the underlying Python script could not be assessed. Before installing, consider whether the reported evaluation and diagnostic commands fit your intended planning use; the scan does not establish their effects.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The visible commands have a materially different purpose from the declared planning workflow. Nothing in the supplied chunk creates implementation plans, records decisions, or maintains recovery state, nor does it establish that these evaluation commands support an active planning task. The underlying Python script is not supplied, so further effects or resource access cannot be determined.

Content

No source excerpt is available for this finding.

Memory Manipulation

High
Category
Memory Poisoning
Confidence
85% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · references/plan-deepening.md (reported line 13)May include surrounding context.

md
2. Identify phases or tasks that are vague, under-specified, or missing verification steps
3. For each weak area, run targeted research (read relevant code, check existing patterns, verify assumptions)
4. Expand the weak sections with concrete file paths, decisions (signatures, assertions, spec values), and verification steps
5. Preserve supported decisions; replace instructions contradicted by verified evidence. Keep useful superseded rationale in a separate decision-history note, not in the active execution steps.

Maintain one internally consistent current plan. Restructure only where needed to resolve a gap or contradiction, and report material decision changes.