ClawHub
Back to skill

Security audit

Car

Security checks for vulnerabilities and agentic risk

Overview

This is a plain-text car advice skill with coherent content, but users should treat its DIY repair and roadside steps as general guidance rather than a substitute for professional help or vehicle-specific safety instructions.

Installers should understand this skill is general automotive guidance. Use the owner's manual, stay out of traffic, avoid high-voltage hybrid/EV systems, and call roadside assistance or a mechanic when conditions, tools, or experience are uncertain.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The roadside-fix section gives actionable mechanical and safety instructions for dead batteries, overheating, and running out of gas without clearly warning that some procedures can be hazardous or inappropriate for certain users and vehicle types. In a car-emergency skill, users may follow this advice under stress, increasing the risk of burns, electrical injury, traffic exposure, or vehicle damage if they attempt steps beyond their competence or outside their owner's-manual guidance.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The guide explicitly encourages DIY tasks including oil changes and battery replacement without any accompanying safety cautions about burns, hot oil, jack/support hazards, battery acid, short-circuit risk, or proper disposal. In a car-maintenance skill, users may rely on this as practical instruction, so omission of basic safety warnings can foreseeably contribute to injury or unsafe repair behavior.

Static analysis

No suspicious patterns detected.