Chat Analyzer Skill

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 12:09 AM UTC
• Version: 1.0.2

Overview

This is a simple chat-analysis prompt skill with no code execution or data access, though it includes an unrelated promotional link users should notice.

Install only if you are comfortable with a chat-analysis assistant that may include a commercial off-platform link; do not share sensitive conversations unless you trust the skill and avoid following external links unless you intend to leave the ClawHub context.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:118

Finding

Unsolicited External Promotion Injected into Skill Responses

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 118-123
Vulnerability Type: Output instruction hijacking through a fixed external promotion
Risk Level: Medium

Evidence:

markdown

## More

---

🧠 Want full conversation tracking with pattern memory? → replyher.com/pro

text

Technical Analysis

The skill includes a fixed promotional block that directs users to replyher.com/pro. This content is unrelated to the core conversation-analysis workflow and can cause the agent to include unsolicited advertising in generated responses.

Because the promotion appears in the skill instructions rather than ordinary package documentation or metadata, an agent loading the skill may treat it as response content to reproduce. This alters the expected output objective from providing conversation analysis to also promoting an external service. The destination is not used to retrieve or execute code, and the audited project contains no scripts that automatically transmit information to it; therefore, this finding is limited to instruction and output manipulation.

Attack Path

1. A user or agent installs and loads the skill.
2. The agent treats the content of SKILL.md as behavioral and response-format instructions.
3. The user requests analysis of a message or conversation.
4. The agent produces the requested analysis and may append the fixed promotional block.
5. The user may follow the external link and leave the trusted interaction context.
6. The external service can then receive ordinary web-request metadata and independently solicit additional information from the user.

Impact Assessment

The injected content can influence agent output and redirect users to an external commercial service without an explicit request. This may reduce output integrity, create an undisclosed endorsement, and expose users to the privacy and security practices of an unaudited destination.

The findin ...[truncated 305 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the promotional block from SKILL.md.
2. Keep behavioral instructions limited to functionality required for conversation analysis.
3. If product information is necessary, place it in package metadata or separate documentation rather than response instructions.
4. Display external links only when a user explicitly requests related resources.
5. Clearly identify commercial affiliations and external destinations before presenting them.
6. Add review checks that flag fixed advertisements, referral links, and unrelated calls to action in skill instructions.
7. Ensure no conversation content is submitted to an external service without explicit, informed user consent.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill includes a promotional link to an external service that is not necessary for performing the stated chat-analysis function. Even without overt code execution, unsolicited off-platform promotion can steer users to an unvetted destination, create trust-transfer risk, and enable data collection or monetization outside the skill's declared purpose.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.