ClawHub
Back to skill

Security audit

Irish

Security checks for vulnerabilities and agentic risk

Overview

This is a simple Irish writing-style skill with no code execution, data access, persistence, or hidden system behavior.

Install this only if you want Irish output to sound casual and conversational. For schoolwork, formal writing, translation fidelity, or pure Irish without English mixing, explicitly ask the agent for that style when using the skill.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The skill is framed as a broad writing-style instruction for Irish output rather than a narrowly scoped transformation, so it could be invoked for many general Irish-language requests and silently steer responses toward a specific style. That increases the chance of unintended behavior, especially when the user did not ask for casual, code-switched, or dialect-like output.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
Setting a default register of casual Irish without user opt-in can override the user's intended tone, formality, or audience requirements. In language-generation skills, silent default transformations are risky because they can produce unsuitable output for professional, educational, or sensitive contexts.

Natural-Language Policy Violations

Medium
Confidence
97% confidence
Finding
Directing the model to mix English into Irish by default can conflict with user expectations for pure Irish, educational correctness, or translation fidelity. This is especially problematic because it introduces unsolicited content changes rather than merely adjusting wording style.

Natural-Language Policy Violations

Low
Confidence
86% confidence
Finding
The 'Native Test' instruction encourages a final style rewrite before sending, which may bias the system toward modifying content to avoid sounding 'AI-generated' even when the user did not request that transformation. In context this is less severe than the other findings, but it still creates pressure to override user preference for formality, purity, or literalness.

Static analysis

No suspicious patterns detected.