ClawHub
Back to skill

Security audit

Polish

Security checks for vulnerabilities and agentic risk

Overview

This is a small writing-style skill for casual Polish with no code execution or data access, but users should be aware it may make text too informal by default.

Use this skill when you want informal, natural-sounding Polish. For business, legal, medical, customer-facing, or unfamiliar-recipient writing, explicitly ask for formal Polish or avoid this skill.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
82% confidence
Finding
This markdown file describes the skill only as 'Write Polish that sounds human' without specifying when it should be invoked, what inputs it applies to, or any exclusion conditions. In a skill catalog or routing context, that broad description could overlap with many ordinary writing tasks involving Polish and cause unintended activation.

Natural-Language Policy Violations

Medium
Confidence
94% confidence
Finding
The skill hard-codes a casual Polish register and second-person familiarity without requiring user preference or context checks. This can cause the agent to override user intent, produce socially inappropriate or unprofessional output, and weaken instruction fidelity in contexts where formality, deference, or exact tone preservation matters.

Static analysis

No suspicious patterns detected.