JavaScript

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 4:02 PM UTC
• Version: 1.0.6

Overview

This JavaScript helper skill is coherent and educational, with only limited local preference memory that is disclosed and scoped to its own directory.

Installers should be comfortable with the skill keeping JavaScript-related preferences and context in ~/Clawic/data/javascript/. Review or clear that directory if you do not want cross-session memory; no evidence was found of exfiltration, remote code execution, or hidden malicious behavior.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 6)May include surrounding context.

md

---
name: javascript
slug: javascript
version: 1.0.6
changelog: "Full coverage pass: deeper guides, situation-named files, and per-user configuration"
description: >-
  Writes, debugs, and reviews JavaScript: async and the event loop, coercion, closures, dates, Unicode, regex, and modern ES2023+ APIs.
  Use when JS throws TypeError or "undefined is not a function", a promise never settles or a rejection goes unhandled, NaN or
  [object Object] appears, dates shift by a day, sorting or equality misbehaves, memory grows, a regex hangs, JSON loses precision,
  a Node process won't exit or ignores signals, or fetch doesn't reject on a 404;
  also when choosing data structures, handling errors, profiling slow code, or checking whether a feature i

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · browser.md (reported line 19)May include surrounding context.

md

- `.json()` on an empty body (204, some error responses) throws — gate on status or read `.text()` first (`json.md` Safety).
- CORS failures are opaque to JS by design (no status, no detail) — the fix is response headers on the server, never client code. `mode: "no-cors"` is not a workaround: it yields an unreadable opaque response.
- No default timeout: `AbortSignal.timeout` (SKILL.md Traps; combinators in `async.md`).
- Cross-origin cookies need BOTH `credentials: "include"` and the server's `Access-Control-Allow-Credentials` — one without the other silently sends nothing.
- Exit-time reporting: `navigator.sendBeacon` or `fetch(url, {keepalive: true})` — an ordinary fetch is killed with the page.

## Storage

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · memory-template.md (reported line 13)May include surrounding context.

md

last: YYYY-MM-DD

## Context
<!-- Their stack: Node version(s), browser targets, TypeScript, frameworks, bundler -->
<!-- Project layout: monorepo, module system, test runner -->

## Pain Points

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · memory-template.md (reported line 14)May include surrounding context.

md

## Context
<!-- Their stack: Node version(s), browser targets, TypeScript, frameworks, bundler -->
<!-- Project layout: monorepo, module system, test runner -->

## Pain Points
<!-- Bug classes they've hit: async races, coercion, memory, floors -->

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 85% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · setup.md (reported line 7)May include surrounding context.

md

## Your Attitude

JavaScript's sharp edges are semantic, not syntactic: coercion, async ordering, and runtime floors bite silently. You catch the bug class, not just the bug, and you say which file of this skill carries the depth. Be precise, cite the rule, and never lecture about style the user didn't ask about.

## How To Load Preferences

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill both reads and writes persistent user-related files but provides no user-facing warning, consent, or transparency about that behavior. Silent persistence is dangerous because users may reveal tooling, conventions, or project context during normal work without understanding that it will be retained locally across sessions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill instructs the agent to persist user preferences and prior context into local files even though the skill’s primary purpose is JavaScript assistance, not stateful profile management. This creates unnecessary data retention and expands the skill’s authority surface, which can expose sensitive user habits or project details across sessions without a clear need or explicit consent flow.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The setup directs the skill to read persistent local preference and memory files on first use without establishing that such access is necessary for JavaScript debugging or review. While reading local state is less risky than writing it, it still broadens data access and may pull in unrelated or sensitive prior context without the user realizing it.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.