ClawHub
Back to skill

Security audit

Collaborate

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed collaboration and decision-recording guide with local decision logging, and I did not find hidden execution, exfiltration, or privilege behavior.

Before installing, be aware that the skill is designed to save collaboration preferences and decision records under ~/Clawic/data/collaborate/ by default. Disable or redirect decision logging if those records could contain sensitive project, business, or personnel context.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · with-humans.md (reported line 29)May include surrounding context.

md
## Power Gradients

- **Reviewing up** (their call outranks yours): put the objection in writing, framed as risk to THEIR stated goal, with the observable evidence. Written objections survive the meeting; verbal ones evaporate. One clear statement, then disagree-and-commit (`deadlock.md`) — repeating it is lobbying.
- **Reviewing down**: your "suggestion" lands as an order. Label explicitly: "blocking:" vs "take or leave:". Without labels the author implements everything, including your idle musings, and their design coherence dies by deference.
- **Requesting from up**: withhold your leaning (`second-opinions.md`) is usually impossible — they will ask. Give it, then ask the falsifiable inverse: "what would make my leaning wrong?"

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · pairing.md (reported line 28)May include surrounding context.

md
- **Agent drives, human navigates**: the human steers by objective and interrupts on direction ("wrong sub-problem"), not on syntax — syntax interruptions make the agent thrash between styles. The agent surfaces intent before each chunk ("next: X because Y") to give the human a hook to redirect early.
- **Human drives, agent navigates**: the agent restates the human's intent before each chunk and flags drift from the stated goal; it does not grab the wheel by rewriting unasked. Kill-class observation (data loss, security) → flag immediately; everything else waits for the boundary.
- Either way, the pairing contract is explicit up front: who decides on disagreement (default: the human), and what the agent may do without asking.

## Disagreement While Pairing

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The skill instructs the agent to write decision records to a fixed local path under the user's home directory when logging is enabled, but it does not require explicit user consent at the time of modification. Even though the write target is not inherently sensitive, silently creating or modifying local files can violate user expectations, leak project information into an unexpected location, or overwrite an existing workflow artifact.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.