ClawHub
Back to skill

Security audit

Skilllab

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for skill-library maintenance, but its autonomous audit mode can execute code from other installed skills and its workflows can broadly mutate, archive, sanitize, commit, and push skill files.

Install only if you intend to let an agent manage local skill libraries and git-backed skill repos. Do not run the autonomous 10khr/audit evaluator against untrusted skills unless it is sandboxed with no secrets, no network, and a disposable copy of the library. Preview any rename, delete/archive, sanitize, publish, commit, or push action before allowing it.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/critique_10khr_runner.py:402
Finding

Automated assessment executes untrusted Skill code

Content
View full analysis

Vulnerability Details

File Location: scripts/critique_10khr_runner.py:402-407, 586-592, 218-250; triggered by SKILL.md:132 and scripts/10khr_cron_verify.py:149-152
Vulnerability Type: Execution of untrusted code during automated static assessment
Risk Level: High

Technical Analysis

The Skill instructs autonomous workflows to run the verifier first:

markdown
- [ ] Run `python3 scripts/10khr_cron_verify.py` FIRST in any autonomous pass — its output is authoritative for what to grind

The verifier imports the runner and assesses discovered Skills:

python
runner = load_runner()
state = runner.load_state()
assessment = runner.run_full_assessment()

During assessment, the runner executes each target Skill's unittest suite:

python
tdir = os.path.join(skill_dir, "tests")
if not (os.path.isdir(tdir) and glob.glob(os.path.join(tdir, "test_*.py"))):
    score -= 2; findings.append("no tests")
else:
    rc, out = _run(
        [sys.executable, "-m", "unittest", "discover", "-s", "tests"],
        cwd=skill_dir
    )
    if rc != 0:
        score -= 2
        findings.append(
            "tests FAIL: " + (out.strip().splitlines() or ["?"])[-1][:60]
        )

It also executes Python and shell scripts with --help because execution checks are enabled:

python
SCRIPT_TIMEOUT = 30
EXECUTE_CHECKS = True
python
if execute:
    cmd = (
        ["bash", name, "--help"]
        if name.endswith(".sh")
        else [sys.executable, name, "--help"]
    )
    rc, _ = _run(cmd, cwd=script_dir)
    ok.append(name) if rc == 0 else broken.append(
        "%s (rc=%d)" % (name, rc)
    )
python
script_dir = os.path.join(skill_dir, "scripts")
_ok, broken_help, _n = check_scripts_help(
    script_dir,
    execute=EXECUTE_CHECKS
)

The assessment recursively discovers ocas-* and util-* Skills from profile directories. A Skill author controls its tests/test_*.py, scripts/*.py, and scripts/*.sh files. Python mod ...[truncated 2029 chars]

Remediation
View remediation

Remediation Suggestions

  • Make assessment static by default. Set EXECUTE_CHECKS = False and remove direct unittest discovery from untrusted Skill assessment.
  • Do not use a textual outbound-operation blacklist as an authorization or execution boundary.
  • Analyze scripts using source parsing and AST inspection without importing or executing target modules.
  • If runtime validation is necessary, run it only in a disposable sandbox with:
    • No inherited credentials or sensitive environment variables.
    • No network access.
    • A read-only copy of the target.
    • No access to home directories or shared Skill/profile state.
    • Strict CPU, memory, process, and time limits.
    • A non-privileged, dedicated OS identity.
  • Require explicit user approval that identifies the exact Skill and files before any runtime validation.
  • Separate static assessment from opt-in dynamic testing, and clearly label dynamic testing as execution of untrusted code.
  • Apply the same isolation requirements to test suites, --help checks, import checks, and any PII gate scripts.

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (150)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The skill claims it never hardcodes a single path and supports broad autonomous critique and maintenance, yet the finding indicates hardcoded profile targeting and undeclared file-rewriting/quarantine behavior. Hidden write behavior plus inaccurate scoping is dangerous because operators cannot reliably predict what content will be modified or moved.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill claims it never hardcodes a single path and supports broad autonomous critique and maintenance, yet the finding indicates hardcoded profile targeting and undeclared file-rewriting/quarantine behavior. Hidden write behavior plus inaccurate scoping is dangerous because operators cannot reliably predict what content will be modified or moved.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The skill claims it never hardcodes a single path and supports broad autonomous critique and maintenance, yet the finding indicates hardcoded profile targeting and undeclared file-rewriting/quarantine behavior. Hidden write behavior plus inaccurate scoping is dangerous because operators cannot reliably predict what content will be modified or moved.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill claims it never hardcodes a single path and supports broad autonomous critique and maintenance, yet the finding indicates hardcoded profile targeting and undeclared file-rewriting/quarantine behavior. Hidden write behavior plus inaccurate scoping is dangerous because operators cannot reliably predict what content will be modified or moved.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill claims it never hardcodes a single path and supports broad autonomous critique and maintenance, yet the finding indicates hardcoded profile targeting and undeclared file-rewriting/quarantine behavior. Hidden write behavior plus inaccurate scoping is dangerous because operators cannot reliably predict what content will be modified or moved.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The skill claims it never hardcodes a single path and supports broad autonomous critique and maintenance, yet the finding indicates hardcoded profile targeting and undeclared file-rewriting/quarantine behavior. Hidden write behavior plus inaccurate scoping is dangerous because operators cannot reliably predict what content will be modified or moved.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The skill claims it never hardcodes a single path and supports broad autonomous critique and maintenance, yet the finding indicates hardcoded profile targeting and undeclared file-rewriting/quarantine behavior. Hidden write behavior plus inaccurate scoping is dangerous because operators cannot reliably predict what content will be modified or moved.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.

md
- Dated narratives behind every rule: `references/skilllab-pitfalls.md` ("Extracted" appendix) + `references/critique-10khr-grind-pitfalls.md`; cron constraints

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 212)May include surrounding context.

md
- Dated narratives behind every rule: `references/skilllab-pitfalls.md` ("Extracted" appendix) + `references/critique-10khr-grind-pitfalls.md`; cron constraints

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 164)May include surrounding context.

md
port files behind. Parallel-copy dedupe: 7-step superset-verified procedure in `references/merge-parallel-copy-dedupe.md` — read before ANY cross-tree dedupe; n

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/critique-10khr-2026-05-31.md (reported line 14)May include surrounding context.

md
## What was fixed

1. **Known Code Fixes section (~50 lines)** — Full Python code patches for `oc_platform_sms_auto_detect_override` and `oc_telegram_edit_finalize`, plus the Escalation Runner Pattern workflow, moved to `references/known-code-fixes-and-cascade.md` (D3: 3→5, D8: 3→5)
2. **Duplicate Self-Update procedure (7 steps)** — Already had `references/self-update.md` but also had a full 7-step inline copy. Inline copy removed, reference pointer only retained. (D3: +delta)
<<<<<<< Updated upstream
3. **MCP Cascade section** — Full bash snippet with absolute path `<hermes-home>/config.yaml` moved to reference file. Fixed phantom reference `util-ustodian/references/mcpcascade-triage.md` (doesn't exist) — replaced with pointer to `util-hermes-ops/references/mcp-cascade-triage.md`. (D5: 4→5)
=======

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/critique-10khr-2026-06-29-session-2.md (reported line 42)May include surrounding context.

md
## What was fixed

1. **Known Code Fixes section (~50 lines)** — Full Python code patches for `oc_platform_sms_auto_detect_override` and `oc_telegram_edit_finalize`, plus the Escalation Runner Pattern workflow, moved to `references/known-code-fixes-and-cascade.md` (D3: 3→5, D8: 3→5)
2. **Duplicate Self-Update procedure (7 steps)** — Already had `references/self-update.md` but also had a full 7-step inline copy. Inline copy removed, reference pointer only retained. (D3: +delta)
<<<<<<< Updated upstream
3. **MCP Cascade section** — Full bash snippet with absolute path `<hermes-home>/config.yaml` moved to reference file. Fixed phantom reference `util-ustodian/references/mcpcascade-triage.md` (doesn't exist) — replaced with pointer to `util-hermes-ops/references/mcp-cascade-triage.md`. (D5: 4→5)
=======

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/critique-10khr-learnings.md (reported line 71)May include surrounding context.

md
## What was fixed

1. **Known Code Fixes section (~50 lines)** — Full Python code patches for `oc_platform_sms_auto_detect_override` and `oc_telegram_edit_finalize`, plus the Escalation Runner Pattern workflow, moved to `references/known-code-fixes-and-cascade.md` (D3: 3→5, D8: 3→5)
2. **Duplicate Self-Update procedure (7 steps)** — Already had `references/self-update.md` but also had a full 7-step inline copy. Inline copy removed, reference pointer only retained. (D3: +delta)
<<<<<<< Updated upstream
3. **MCP Cascade section** — Full bash snippet with absolute path `<hermes-home>/config.yaml` moved to reference file. Fixed phantom reference `util-ustodian/references/mcpcascade-triage.md` (doesn't exist) — replaced with pointer to `util-hermes-ops/references/mcp-cascade-triage.md`. (D5: 4→5)
=======

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/critique-10khr-2026-05-31.md (reported line 14)May include surrounding context.

md
## Fix Patterns That Consistently Work

1. **Inline content to references/**: Moving storage layouts, OKR YAML, init sequences, self-update procedures improves D3/D4/D8 by 1-2 points each.
2. **Code ratio**: Under 20% target.
3. **Description NOT clause**: "NOT for" scores 5, "Do not use for" or "Not for:" scores 3-4.
4. **Duplicate section removal**: Many skills have both `## When to Use` and `## When to use` (non-standard casing). Consolidating gives +1-2 on D4.

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/critique-10khr-2026-06-27-look-session.md (reported line 37)May include surrounding context.

md
## Fix Patterns That Consistently Work

1. **Inline content to references/**: Moving storage layouts, OKR YAML, init sequences, self-update procedures improves D3/D4/D8 by 1-2 points each.
2. **Code ratio**: Under 20% target.
3. **Description NOT clause**: "NOT for" scores 5, "Do not use for" or "Not for:" scores 3-4.
4. **Duplicate section removal**: Many skills have both `## When to Use` and `## When to use` (non-standard casing). Consolidating gives +1-2 on D4.

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/critique-10khr-may-2026-learnings.md (reported line 11)May include surrounding context.

md
## Fix Patterns That Consistently Work

1. **Inline content to references/**: Moving storage layouts, OKR YAML, init sequences, self-update procedures improves D3/D4/D8 by 1-2 points each.
2. **Code ratio**: Under 20% target.
3. **Description NOT clause**: "NOT for" scores 5, "Do not use for" or "Not for:" scores 3-4.
4. **Duplicate section removal**: Many skills have both `## When to Use` and `## When to use` (non-standard casing). Consolidating gives +1-2 on D4.

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/critique-10khr-may-2026-learnings.md (reported line 16)May include surrounding context.

md
## Fix Patterns That Consistently Work

1. **Inline content to references/**: Moving storage layouts, OKR YAML, init sequences, self-update procedures improves D3/D4/D8 by 1-2 points each.
2. **Code ratio**: Under 20% target.
3. **Description NOT clause**: "NOT for" scores 5, "Do not use for" or "Not for:" scores 3-4.
4. **Duplicate section removal**: Many skills have both `## When to Use` and `## When to use` (non-standard casing). Consolidating gives +1-2 on D4.

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/critique-10khr-may-2026.md (reported line 147)May include surrounding context.

md
## Fix Patterns That Consistently Work

1. **Inline content to references/**: Moving storage layouts, OKR YAML, init sequences, self-update procedures improves D3/D4/D8 by 1-2 points each.
2. **Code ratio**: Under 20% target.
3. **Description NOT clause**: "NOT for" scores 5, "Do not use for" or "Not for:" scores 3-4.
4. **Duplicate section removal**: Many skills have both `## When to Use` and `## When to use` (non-standard casing). Consolidating gives +1-2 on D4.

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/critique-10khr-may-2026.md (reported line 149)May include surrounding context.

md
## Fix Patterns That Consistently Work

1. **Inline content to references/**: Moving storage layouts, OKR YAML, init sequences, self-update procedures improves D3/D4/D8 by 1-2 points each.
2. **Code ratio**: Under 20% target.
3. **Description NOT clause**: "NOT for" scores 5, "Do not use for" or "Not for:" scores 3-4.
4. **Duplicate section removal**: Many skills have both `## When to Use` and `## When to use` (non-standard casing). Consolidating gives +1-2 on D4.

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/critique-10khr-may-2026.md (reported line 167)May include surrounding context.

md
## Fix Patterns That Consistently Work

1. **Inline content to references/**: Moving storage layouts, OKR YAML, init sequences, self-update procedures improves D3/D4/D8 by 1-2 points each.
2. **Code ratio**: Under 20% target.
3. **Description NOT clause**: "NOT for" scores 5, "Do not use for" or "Not for:" scores 3-4.
4. **Duplicate section removal**: Many skills have both `## When to Use` and `## When to use` (non-standard casing). Consolidating gives +1-2 on D4.

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/critique-inline-to-refs-pattern.md (reported line 17)May include surrounding context.

md
## Fix Patterns That Consistently Work

1. **Inline content to references/**: Moving storage layouts, OKR YAML, init sequences, self-update procedures improves D3/D4/D8 by 1-2 points each.
2. **Code ratio**: Under 20% target.
3. **Description NOT clause**: "NOT for" scores 5, "Do not use for" or "Not for:" scores 3-4.
4. **Duplicate section removal**: Many skills have both `## When to Use` and `## When to use` (non-standard casing). Consolidating gives +1-2 on D4.

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/critique-10khr-may-2026-learnings.md (reported line 16)May include surrounding context.

md
3. **Description NOT clause**: "NOT for" scores 5, "Do not use for" or "Not for:" scores 3-4.
4. **Duplicate section removal**: Many skills have both `## When to Use` and `## When to use` (non-standard casing). Consolidating gives +1-2 on D4.
5. **Error handling tables**: Adding a failure/response table is the fastest D7 fix — 3→4 in one patch.
6. **Self-update procedure extraction**: Moving the 7-step self-update from SKILL.md to references/ consistently saves 10-19 lines per skill.
7. **YAML single-quoted string fix**: Several skills had `'description'` spanning multiple lines (invalid YAML). Converting to `>` block scalar fixes parsing.

## Process Corrections

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/critique-audit-checklist.md (reported line 62)May include surrounding context.

md
3. **Description NOT clause**: "NOT for" scores 5, "Do not use for" or "Not for:" scores 3-4.
4. **Duplicate section removal**: Many skills have both `## When to Use` and `## When to use` (non-standard casing). Consolidating gives +1-2 on D4.
5. **Error handling tables**: Adding a failure/response table is the fastest D7 fix — 3→4 in one patch.
6. **Self-update procedure extraction**: Moving the 7-step self-update from SKILL.md to references/ consistently saves 10-19 lines per skill.
7. **YAML single-quoted string fix**: Several skills had `'description'` spanning multiple lines (invalid YAML). Converting to `>` block scalar fixes parsing.

## Process Corrections

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/critique-inline-to-refs-pattern.md (reported line 17)May include surrounding context.

md
3. **Description NOT clause**: "NOT for" scores 5, "Do not use for" or "Not for:" scores 3-4.
4. **Duplicate section removal**: Many skills have both `## When to Use` and `## When to use` (non-standard casing). Consolidating gives +1-2 on D4.
5. **Error handling tables**: Adding a failure/response table is the fastest D7 fix — 3→4 in one patch.
6. **Self-update procedure extraction**: Moving the 7-step self-update from SKILL.md to references/ consistently saves 10-19 lines per skill.
7. **YAML single-quoted string fix**: Several skills had `'description'` spanning multiple lines (invalid YAML). Converting to `>` block scalar fixes parsing.

## Process Corrections

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/critique-10khr-may-2026.md (reported line 13)May include surrounding context.

md
- **Reusable for:** ALL skills with a references/ directory. This is the #1 D1 failure across the library.

### Fix D9: Script lacks --help
- **Pattern:** `self_update.sh` had no `--help` flag
- **Fix:** Added `[[ "${1:-}" == "--help" || "${1:-}" == "-h" ]]` block with usage, description, and options
- **Reusable for:** Every script in any skill's `scripts/` directory.