ClawHub
Back to skill

Security audit

Sentiment Tracker

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its public-sentiment monitoring purpose, but it also tells the agent to save activation preferences into shared main memory while claiming tracking data stays local.

Review this before installing if you do not want a skill to influence future sessions. One-off sentiment checks are aligned with the skill's purpose, but ongoing monitoring should require explicit consent, clear schedule limits, and storage only in the local sentiment-analysis folder unless you knowingly opt into shared memory.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T02 · Agent Memory Poisoning

Warning
Location
setup.md:21
Finding

Cross-Session Behavior Modification Through Main Memory

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · memory-template.md (reported line 21)May include surrounding context.

md
default_timeframe: 7d

## Entities
<!-- List of tracked entities, one per line -->
<!-- Format: name | type | schedule | platforms -->

| Entity | Type | Schedule | Platforms |

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · memory-template.md (reported line 153)May include surrounding context.

md
# Alert History

## Active Alerts
<!-- Alerts that haven't been acknowledged -->

### YYYY-MM-DD HH:MM — {Entity}
**Type:** negative_spike

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file claims that all tracking data stays locally on the user's machine, but later directs the agent to save information to MAIN memory across sessions. This inconsistency is dangerous because it misleads users about where their data is stored and undermines informed consent around persistence and data sharing.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill instructs saving user preferences to "MAIN memory" shared across sessions, which expands data persistence beyond the stated local skill scope. This creates unnecessary cross-session profiling risk and can expose user preferences to other workflows or skills without a clear need tied to sentiment monitoring.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill directs persistent storage of user preferences without a clear user-facing disclosure at the moment of collection and storage. Even if the data seems low sensitivity, silent persistence can accumulate behavioral preferences and monitoring choices that users did not knowingly authorize to be retained.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The instructions say to save learned entities, alert thresholds, report preferences, and platform priorities to a local file, but they do not require a contemporaneous disclosure to the user that this profiling data is being persisted. This creates a privacy and transparency issue because operational preferences and tracked interests may reveal sensitive business focus or personal interests over time.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.