ClawHub
Back to skill

Security audit

Kotlin

Security checks for vulnerabilities and agentic risk

Overview

This Kotlin helper skill is a coherent documentation and preference-based coding aid, with disclosed local preference memory and no evidence of hidden execution, exfiltration, or destructive behavior.

Before installing, understand that this skill may read and maintain Kotlin-specific preferences in ~/Clawic/data/kotlin/. Review or delete those files if you do not want persistent tailoring across sessions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Ae1

High
Category
analysis-evasion
Content
| Scope functions, sealed hierarchies, delegation, destructuring, `use`, DSL builders | `idioms.md` |
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
| Scope functions, sealed hierarchies, delegation, destructuring, `use`, DSL builders | `idioms.md` |
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Memory Manipulation

High
Category
Memory Poisoning
Content
| Situation | Shape |
|---|---|
| Validation, not-found, offline, "already exists" | Typed result: `sealed interface LoginResult { data class Ok(…) ; data object WrongPassword ; data class Locked(val until: Instant) }` |
| Caller cannot proceed and cannot fix it (broken invariant, corrupt state) | `throw IllegalStateException` / `error("…")` |
| Caller passed something impossible | `require(...)` → `IllegalArgumentException` |
| I/O that the layer above can retry or surface generically | Throw, and translate at the layer that has UI or policy context |
| Parsing untrusted input | Typed result; a parser that throws forces every caller into `try/catch` |
Confidence
90% confidence
Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Natural-Language Policy Violations

Medium
Confidence
94% confidence
Finding
The setup directs the skill to avoid interviewing the user, to infer preferences silently, and to proceed without asking for consent or confirmation. That removes an important transparency and consent checkpoint, increasing the chance of incorrect assumptions, hidden data collection, and unauthorized persistent profiling when combined with the file read/write behavior.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill explicitly instructs the agent to read from and write to persistent files under the user's home directory, including preferences and session memory, without any user-facing disclosure or consent mechanism in the setup text. This creates a privacy and integrity risk because sensitive workflow details or preferences may be silently collected, retained across sessions, and modified in ways the user does not expect.

Static analysis

No suspicious patterns detected.