ClawHub
Back to skill

Security audit

OpenAI Symphony

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed runbook for trusted unattended Codex orchestration, with meaningful operational risk but no artifact-backed deception or malicious behavior.

Install only for repositories and Linear projects where unattended coding automation is appropriate. Confirm the workspace root, hooks, credentials, approval policy, and memory retention before launch, start with a test project and low concurrency, and avoid storing API keys or tokens in files or persistent memory.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

External Script Fetching

High
Category
Supply Chain
Content
Before enabling unattended operation, confirm the repository, tracker project, and workspace root are approved by the user. Start with conservative policy (`approval_policy: on-request`) and test-project rollout before broadening scope.

### 6. Apply Bounded Concurrency, Retries, and Safe Hooks
Use explicit concurrency ceilings and exponential backoff for transient failures. Retries must resume from existing workspace state instead of repeating completed investigation work. Allow only deterministic hooks that stay inside the issue workspace and avoid secret exfiltration patterns (`curl | sh`, arbitrary uploads, or parent-directory deletes).

### 7. Preserve Observability and Safety Evidence
Record launch config, workspace path, tracker state transitions, validation proof, and token/runtime metrics for every run. Operators must be able to reconstruct what happened without rerunning the issue.
Confidence
90% confidence
Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Ae1

High
Category
analysis-evasion
Content
- modify its own `SKILL.md`
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Hidden Instructions

High
Category
Prompt Injection
Content
integration: pending | done | declined

## Context
<!-- Team goals for unattended issue orchestration -->
<!-- Trust boundaries, environment constraints, and escalation posture -->

## Environment
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
| Endpoint | Data Sent | Purpose |
|----------|-----------|---------|
| https://api.linear.app/graphql | Issue metadata, state queries, and workflow updates | Tracker polling, reconciliation, and issue-level orchestration |
| https://api.openai.com | Codex app-server requests and model output payloads | Agent execution for implementation turns |
| https://github.com | Repository clone/fetch/push traffic defined by workspace hooks | Prepare and update per-issue code workspaces |
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Vague Triggers

Medium
Confidence
94% confidence
Finding
The setup guidance defines activation in broad terms such as triggering on mentions of Linear automation or unattended coding runs, which can cause the skill to activate outside clear user intent. In an orchestration skill that can influence automation posture and future behavior, ambiguous invocation increases the risk of unintended autonomous actions or applying the wrong workflow in unrelated contexts.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The instruction to save activation boundaries in main memory so future sessions apply them by default directs persistence across sessions without explicit user consent at the time of storage. Even though the content suggests storing operational rather than secret data, cross-session persistence can create privacy, policy, and safety issues if preferences are retained unexpectedly or later applied in the wrong context.

Missing User Warnings

Low
Confidence
84% confidence
Finding
This markdown runbook instructs users to export `LINEAR_API_KEY` and `OPENAI_API_KEY`, which involves handling sensitive credentials. While the checklist mentions that auth must be configured, it does not explicitly warn users to protect these secrets, avoid committing them, or prefer secure secret management.

Static analysis

No suspicious patterns detected.