ClawHub
Back to skill

Security audit

Discover

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed local discovery/watchlist helper with recurring checks gated on user approval, though its setup instructions include a permission-command typo users should fix before running.

Install only if you want a local, durable discovery watchlist. Before running setup, correct the chmod line to target ~/Clawic/data/discover instead of ~/discover, and only enable AGENTS.md routing or HEARTBEAT.md checks for topics you explicitly want tracked over time.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
setup.md:61
Finding

Incorrect Path Causes Unintended Permission Modification

Content
View full analysis

Vulnerability Details

File Location: setup.md, lines 61–65
Vulnerability Type: Incorrect permission target caused by a path typo
Risk Level: Medium

bash
mkdir -p ~/Clawic/data/discover/{findings,archive}
touch ~/Clawic/data/discover/{memory.md,watchlist.md,heartbeat-state.md}
chmod 700 ~/discover ~/Clawic/data/discover/findings ~/Clawic/data/discover/archive
chmod 600 ~/Clawic/data/discover/{memory.md,watchlist.md,heartbeat-state.md}

Technical Analysis

The documented state root is consistently ~/Clawic/data/discover/, but the chmod 700 command targets ~/discover instead of that root. The unrelated path is not created or otherwise used by this skill.

If ~/discover already exists, running the setup block changes its permissions without a legitimate need. At the same time, the intended ~/Clawic/data/discover/ root does not receive mode 700 and may retain permissions inherited from the parent directory or the user's umask.

This is an insecure configuration practice involving an incorrect access-control target. It does not grant the skill elevated operating-system privileges, but it can unexpectedly alter access to unrelated user-owned content and leave the actual state root less restricted than intended.

Attack Path

  1. A user approves initialization of the discovery skill.
  2. The user or agent executes the setup commands from setup.md.
  3. The shell expands ~/discover to an unrelated path in the current user's home directory.
  4. If that path exists and is owned by the executing user, its mode is changed to 700.
  5. Group and other users who previously had legitimate access can no longer access that directory.
  6. Meanwhile, ~/Clawic/data/discover/ does not receive the intended explicit directory permissions.

Exploitation requires the setup block to be executed and an existing, user-modifiable ~/discover path. The effect is limited by the privileges of the account ...[truncated 609 chars]

Remediation
View remediation

Remediation Suggestions

Replace the incorrect permission command with one that targets the documented state root:

bash
chmod 700 ~/Clawic/data/discover \
  ~/Clawic/data/discover/findings \
  ~/Clawic/data/discover/archive

Retain restrictive permissions for the state files:

bash
chmod 600 ~/Clawic/data/discover/{memory.md,watchlist.md,heartbeat-state.md}

For additional hardening:

  1. Resolve and validate the intended state path before modifying permissions.
  2. Avoid applying chmod to paths not created or explicitly managed by the setup procedure.
  3. Use a restrictive creation mask such as umask 077 before creating state directories and files.
  4. Fail safely if the target resolves outside ~/Clawic/data/discover/.
  5. Add a setup test that verifies every permission target is beneath the documented state root.

A hardened setup sequence would be:

bash
umask 077
mkdir -p ~/Clawic/data/discover/{findings,archive}
touch ~/Clawic/data/discover/{memory.md,watchlist.md,heartbeat-state.md}
chmod 700 ~/Clawic/data/discover \
  ~/Clawic/data/discover/findings \
  ~/Clawic/data/discover/archive
chmod 600 ~/Clawic/data/discover/{memory.md,watchlist.md,heartbeat-state.md}

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (11)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The activation criteria are broad enough to match ordinary research or brainstorming requests, which can cause the skill to trigger in situations where the user did not clearly ask for persistent discovery behavior. Because the routing block also directs durable memory use, overbroad activation increases the chance of unintended persistence and silent scope expansion.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The routing block instructs the agent to read and update persistent files under the user's home directory without embedding a clear notice or consent boundary. This is dangerous because a user asking for ideas or opportunities may not realize the agent is consulting prior stored interests or writing new long-lived records, creating privacy and consent risks.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger phrase at this line is broad enough to match ordinary conversational requests, which can cause the skill to activate when the user did not intend persistent discovery behavior. In this skill's context, unintended activation matters because the skill can create durable local state and may later propose or enable recurring monitoring behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This trigger is ambiguous and likely to overlap with many normal brainstorming or research prompts, so the skill may route standard one-off requests into a persistent discovery workflow. Because the skill stores watchlists and findings locally, misrouting can lead to unnecessary data retention and user-surprising behavior.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.

md
| Logging every article or tweet | Noise buries novelty | Apply `novelty-test.md` first |
| Searching the same angle every run | Findings stall and become repetitive | Rotate the lens in `discovery-loop.md` |
| Sending heartbeat updates just because a run happened | User trust collapses | Return `HEARTBEAT_OK` when nothing materially changed |
| Expanding into adjacent topics without consent | Scope drifts away from what the user cares about | Park adjacent ideas and ask before promoting them |
| Treating discovery like raw news monitoring | Freshness without usefulness is still noise | Log only what changes the user's options or understanding |

## External Endpoints

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 177)May include surrounding context.

md
- confuse generic summaries with discoveries
- keep monitoring topics that were never approved for recurrence
- broaden scope silently
- turn discovery into external action without approval

## Related Skills
More Clawic skills, get them at https://clawic.com/skills/<slug> (install if the user confirms):

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The template instructs the agent to record when discovery should "activate automatically" but does not define clear scope, triggers, or consent boundaries. In a skill designed to proactively surface ideas and opportunities, this ambiguity can cause the agent to invoke itself too broadly, leading to unsolicited monitoring, excessive source scanning, or behavior that exceeds user expectations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill defines broad auto-activation triggers such as requests for 'new angles' or vague 'open loops,' which can cause the agent to engage this capability in many ordinary conversations without clear user intent. In this skill, that matters because the behavior includes durable tracking, proactive discovery, and potential heartbeat setup, so overbroad routing can lead to unnecessary persistence or background monitoring features being proposed or activated inappropriately.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · setup.md (reported line 64)May include surrounding context.

bash
mkdir -p ~/Clawic/data/discover/{findings,archive}
touch ~/Clawic/data/discover/{memory.md,watchlist.md,heartbeat-state.md}
chmod 700 ~/discover ~/Clawic/data/discover/findings ~/Clawic/data/discover/archive
chmod 600 ~/Clawic/data/discover/{memory.md,watchlist.md,heartbeat-state.md}

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · setup.md (reported line 65)May include surrounding context.

mkdir -p ~/Clawic/data/discover/{findings,archive} touch ~/Clawic/data/discover/{memory.md,watchlist.md,heartbeat-state.md} chmod 700 ~/discover ~/Clawic/data/discover/findings ~/Clawic/data/discover/archive chmod 600 ~/Clawic/data/discover/{memory.md,watchlist.md,heartbeat-state.md}

text

If the files are empty:

Scope Creep

Low
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 176)May include surrounding context.

md
This skill NEVER:
- confuse generic summaries with discoveries
- keep monitoring topics that were never approved for recurrence
- broaden scope silently
- turn discovery into external action without approval

## Related Skills

Static analysis

No suspicious patterns detected.