ClawHub
Back to skill

Security audit

Food Delivery

Security checks for vulnerabilities and agentic risk

Overview

This food-ordering skill is coherent and disclosed, but users should know it saves dietary, allergy, household, and order-history notes locally and can place orders after confirmation.

Install only if you are comfortable with the agent using your logged-in delivery apps after explicit confirmation and saving food preferences locally. Consider creating ~/food-delivery with owner-only permissions, avoid storing unnecessary medical or religious detail, use aliases for household members, and delete old notes you no longer need.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
memory-template.md:5
Finding

Plaintext Storage of Sensitive Personal and Health Data Without Explicit Access Controls

Content
View full analysis
## Firm Restrictions ``` `memory-template.md:38-43`: ```markdown ## Defaults default_budget: $25 usual_order_time: dinner preferred_platforms: - Uber Eats - DoorDash ``` `memory-template.md:96-112`: ```markdown ## people.md Template Copy to `~/food-delivery/people.md` (for households/groups): ```markdown # Hou ...[truncated 3132 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · decisions.md (reported line 160)May include surrounding context.

md
## Confidence Calibration

**Be confident when:**
- User has clear history
- Request matches past patterns
- You've succeeded before

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · memory-template.md (reported line 18)May include surrounding context.

md
# Food Delivery Preferences

## Critical Restrictions
<!-- Allergies and medical - ALWAYS filter, add note to orders -->
<!-- Format: - allergen (severity if known) -->

## Firm Restrictions

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · memory-template.md (reported line 27)May include surrounding context.

md
<!-- Examples: no pork, vegetarian, halal, kosher, vegan -->

## Avoid
<!-- Taste preferences - consider but flexible -->
<!-- Format: - item -->

## Preferences

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The template explicitly directs storage of household members' allergies, dietary restrictions, and other potentially sensitive health or religious information in plain local markdown files, but provides no privacy, minimization, or retention guidance. This creates unnecessary collection and persistence of sensitive personal data that could be exposed through device compromise, backups, sync services, or unintended sharing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The workflow directs the agent to persist a user's order history and restaurant ratings in local files without an explicit consent or transparency step. That creates a privacy risk because food orders can reveal sensitive personal information such as location, habits, religion, health-related dietary restrictions, and household routines, and the user may not expect this data to be retained beyond completing the order.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · traps.md (reported line 66)May include surrounding context.

md
| Trap | Consequence | Prevention |
|------|-------------|------------|
| No confirmation | Order placed without explicit yes | Always get confirmation before checkout |
| Missing allergy notes | Kitchen unaware of restriction | Add note for EVERY order with CRITICAL items |
| Wrong restaurant | Similar names, wrong location | Verify address before ordering |
| Stale availability | Item shows but unavailable | Handle "out of stock" gracefully |

Static analysis

No suspicious patterns detected.