Security audit

Replyher Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it claims, but it handles sensitive conversations while injecting an external service promotion and ships a risky release script for maintainers.

Review this skill before installing if you plan to paste private chats, workplace messages, screenshots, or relationship details. The core coaching prompt does not show automatic data exfiltration, but it promotes an external service during sensitive interactions and the package's publish script should not be run unless its git changes and npm dependency resolution are reviewed and controlled.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:162
Finding: Mandatory Third-Party Promotion Injected into Agent Responses
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: publish.sh:21
Finding: Unpinned npm Package Is Downloaded and Executed During Publishing
Content: View full analysis
`. 3. Execution reaches `npx clawhub publish ...`. 4. `npx` resolves the package version from the configured package source and may download it. 5. npm lifecycle logic or the package's command-line entry point executes attacker-controlled code. 6. The malicious code runs under the publishing user's account and can access resources available to that process. ### Impact Assessment The dependency executes with the privileges of the user performing ...[truncated 654 chars]
Remediation: View remediation
publish "$DIR" \ --version "$VERSION" \ --changelog "$CHANGELOG" ``` - Verify package provenance and integrity in CI. - Use a restricted release account and an isolated, ephemeral runner. - Provide publishing credentials only to the publication step and scope each token to the minimum required permissions. - Review dependency updates before changing the pinned version. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: publish.sh:13
Finding: Release Script Stages and Pushes Every Repository Change
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description presents an end-user conversational coaching skill, but the supplied code does not implement any message analysis, reply generation, multilingual adaptation, or communication coaching behavior. Instead, it is a deployment utility script whose purpose is to commit code, push to GitHub, and publish a release to ClawHub. These are materially different capabilities and involve external resource access and publishing actions not reflected in the declared purpose or permissions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README encourages users to paste private messages and full chat threads for analysis, which are highly likely to contain sensitive personal, workplace, or relationship information. Because the documentation provides no notice about how such data is handled, stored, shared, or redacted, users may disclose confidential content without informed consent, creating privacy and compliance risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The pro feature list explicitly advertises relationship memory and screenshot recognition, both of which imply collection and possible retention of especially sensitive interpersonal data. Without any disclosure of retention limits, consent requirements, or handling of image/text contents, the skill normalizes submission of private communications in a way that could expose users to privacy harm if the data is stored, reused, or breached.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The language rule says to always reply in the same language the user writes in, which is a fixed language/locale behavior. Under the policy, forcing a specific language behavior without offering a user choice or opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: Using npx clawhub publish without pinning an exact package version allows npx to resolve and execute whatever version is currently available from the registry. If the package is compromised, typo-squatted, or a newer malicious release is published, this release script could run attacker-controlled code during publishing and potentially expose repository contents, tokens, or modify published artifacts.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.