ClawHub
Back to skill

Security audit

Autonomy

Security checks for vulnerabilities and agentic risk

Overview

The skill is transparent about building agent autonomy, but it is broad enough to let an agent take over impactful workflows with reduced notification and unclear guardrails.

Install only if you want an agent to propose and track delegated workflows. Keep approvals narrow, written, and task-specific; do not allow full autonomy for production deployments, access control, financial actions, data deletion, external communications, or sensitive account changes unless you have separate review, logging, and rollback controls.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

md
I noticed: [what you observed in our chats]
Pattern: [how often you've asked for this]

Proposal: I could handle [specific task] without asking each time.

Pilot: First 5x I'll do it and tell you after.
Then: Full autonomy if you're happy.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.

md
I noticed: [what you observed in our chats]
Pattern: [how often you've asked for this]

Proposal: I could handle [specific task] without asking each time.

Pilot: First 5x I'll do it and tell you after.
Then: Full autonomy if you're happy.

Ssd 4

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The document presents a systematic playbook for transferring responsibilities from the human to the agent until the human is no longer notified and 'forgets' the agent performs the task. In security terms, this is dangerous because it encourages erosion of oversight and normalizes stealthier operation patterns, which can enable unauthorized actions, persistence, and abuse if applied to sensitive or impactful tasks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill explicitly normalizes progression from supervised operation to 'Autonomous + Notify' and then 'Full Ownership' without defining task-scope limits, safety gates, or categories of actions that must always retain human approval. That creates a real risk of over-delegation for actions affecting user data, production systems, or security-sensitive workflows, especially because success is framed in terms of reduced human involvement rather than risk-aware control boundaries.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.