ClawHub
Back to skill

Security audit

Basketball

Security checks for vulnerabilities and agentic risk

Overview

This basketball coaching skill is a disclosed, purpose-aligned set of Markdown workflows with opt-in local notes and no executable payloads or hidden data movement.

Before enabling memory, confirm when you want the skill to activate and what basketball context may be saved locally. Decline local notes if you only want one-off basketball analysis.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
94% confidence
Finding
The activation scope is defined broadly enough that the skill may engage on loosely related basketball topics and begin using or updating persistent memory outside a narrowly intended context. In a memory-enabled skill, overbroad triggers can lead to unnecessary retention of user context or silent carryover of assumptions across sessions, even though this template also includes some limiting guidance such as opt-in memory and prohibitions on sensitive data storage.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The skill instructs activation for broadly defined basketball-related discussion, including general games, film, lineups, and roster-fit topics, and suggests proactive activation for matchup and lineup debates. This can cause the agent to engage or persist skill-specific behavior in situations where the user did not explicitly request it, increasing the chance of over-collection of contextual data or inappropriate scope expansion.

Static analysis

No suspicious patterns detected.