ClawHub
Back to skill

Security audit

Create Content

Security checks for vulnerabilities and agentic risk

Overview

The skill is a content-writing helper, but it can pull from private notes, journals, and prior sessions without enough user-directed scoping.

Review this skill before installing if your agent can access private notes, journals, or prior conversations. Use it only with explicit source limits, and approve any personal or business details before turning them into public posts.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:36
Finding

Unscoped Access to Private User Records

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 36-40
Vulnerability Type: Unscoped access to privacy-sensitive user data
Risk Level: Medium

Vulnerable Code

markdown
### If user says "help me figure out what to post":

1. Search for recent notes, journal entries, sessions
2. Look for: observations, breakthroughs, experiments, patterns noticed
3. Present 2-3 potential angles and ask which resonates

Technical Analysis

The skill directs the agent to search recent notes, journal entries, and sessions whenever a user asks for help deciding what to post. It does not require explicit consent before accessing those records, identify approved data sources, restrict the time range, or exclude sensitive and unrelated material.

This violates least-privilege principles because a generic content-ideation request may trigger access to substantially more personal information than is necessary. If the host agent has tools capable of searching private notes or prior sessions, sensitive records could be loaded into the active context and used to generate publishing suggestions.

The instruction does not establish a mechanism for obtaining additional system permissions, and no external exfiltration endpoint is present. The risk instead arises from directing an already authorized agent to use its available access too broadly.

Attack Path

  1. A user invokes the skill and asks, “help me figure out what to post.”
  2. The skill interprets this phrase as authorization to search notes, journals, and previous sessions.
  3. The agent queries every accessible source without a source allowlist or defined time range.
  4. Personal, confidential, or otherwise unrelated information enters the agent’s working context.
  5. The agent derives content angles from that information.
  6. Sensitive facts may be exposed directly or indirectly in suggested social-media content.

Impact Assessment

The behavior may expose any notes, journal entries, or session re ...[truncated 542 chars]

Remediation
View remediation

Remediation Suggestions

  1. Require explicit, informed consent before searching any private notes, journals, or previous sessions.
  2. Ask the user to select specific sources and a narrow time range before initiating a search.
  3. Exclude private sessions, sensitive directories, and records containing credentials, health data, financial information, or third-party personal data by default.
  4. Apply data minimization by retrieving only short, relevant excerpts rather than complete records.
  5. Present sanitized topic summaries for approval before incorporating source details into a draft.
  6. Prevent private details from appearing in public-facing content unless the user explicitly approves each detail.
  7. Replace the current instruction with a consent-aware workflow, for example:
markdown
1. Ask whether the user wants to provide material directly or authorize a search.
2. If the user authorizes a search, ask them to select specific sources and a time range.
3. Search only the approved scope and exclude sensitive records by default.
4. Present sanitized topic summaries without quoting private source material.
5. Obtain approval before using personal details in a draft.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
85% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

md
### DO:

- Short sentences. Like texting.
- Observations over wisdom. Show, don't preach.
- Specific numbers. "$120K ARR" not "good revenue"
- Personal mixed with insight
- Real examples with data

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The usage trigger accepts highly generic natural-language input such as a rough idea, topic, or 'help me figure out what to post,' which can overlap with ordinary conversation and cause the skill to activate in situations the user did not clearly intend. In an agent environment, this increases the chance of prompt/skill confusion and unintended routing into this skill, potentially shaping outputs or causing access to user notes when the user only made a casual request.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The quick commands use short, common phrases like 'thread about [topic],' 'explore,' and 'help me think,' which are ambiguous and likely to appear in normal user dialogue outside an explicit tool invocation context. This makes accidental or adversarial triggering easier, especially in multi-skill systems where broad phrases can hijack routing and steer the assistant into this skill unexpectedly.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.