Utrecht

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 10:56 PM UTC
• Version: 1.0.0

Overview

This is a static Utrecht city guide with some quality and freshness caveats, but no hidden execution, data access, persistence, or deceptive behavior was found.

Reasonable to install as an informational Utrecht guide. Before relying on consequential details, verify current official sources for immigration, taxes, healthcare, housing prices, fines, and school options; also review any related skill package before approving an optional install command.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:159
• Finding: Unpinned Third-Party Skill Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 159-166 **Vulnerability Type**: Unverified and unpinned third-party Skill dependencies **Risk Level**: Medium **Vulnerable Code:** ```markdown ## Related Skills Install with `clawhub install <slug>` if user confirms: - `dutch` — Dutch language learning and practice - `travel` — Travel planning and trip organization - `career` — Career development and job search - `freelance` — Freelancing guidance and contracts - `plan` — General planning and goal setting ``` ### Technical Analysis The Skill recommends installing third-party Skills through mutable package slugs. It does not pin versions, identify trusted publishers, specify integrity hashes or signatures, or require inspection of the resolved package before installation. User confirmation reduces the likelihood of an unexpected installation, but it does not verify dependency integrity. If a referenced slug is compromised, transferred, replaced, or resolved from an unsafe source, the installed package could contain hostile instructions or executable components that were not present during this audit. ### Attack Path 1. An attacker compromises, replaces, or gains control of one of the referenced Skill slugs. 2. The Utrecht Skill recommends that dependency for a related user request. 3. The user confirms installation, believing the recommendation implies the dependency is trusted. 4. The Agent executes `clawhub install <slug>` without a pinned version or integrity verification. 5. The malicious dependency is loaded and may introduce hostile instructions or executable behavior according to the permissions available to the Skill runtime. ### Impact Assessment The immediate file does not itself execute a malicious payload. The potential impact depends on the installed dependency and the permissions granted by the Agent platform. A compromised dependency could alter Agent behavior, expose d ...[truncated 391 chars]
• Remediation: ## Remediation Suggestions 1. Pin each recommended dependency to a reviewed immutable version rather than installing by mutable slug alone. 2. Record and verify the dependency publisher, package source, and cryptographic checksum or signature. 3. Display the resolved package name, version, publisher, requested permissions, and source before asking for user approval. 4. Require security review of dependency contents, including instruction files and executable scripts, before installation. 5. Apply least-privilege sandboxing to installed Skills and deny filesystem, network, credential, and command-execution access unless explicitly required. 6. Maintain an allowlist of approved dependency versions and alert users if the resolved artifact differs from the reviewed version. 7. Prefer describing related capabilities without issuing an installation command when dependency integrity cannot be established.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (12)

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

- **Don't stop in bike lane**
- **Ring bell** when passing
- **Keep right** when slow
- **Never brake suddenly** without warning

### Alcohol
- Legal limit exists (lower than car)

• Confidence: 80% confidence
• Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The activation condition 'User asks about Utrecht for any purpose' is extremely broad and can cause the agent to invoke this skill for loosely related queries without sufficient narrowing. Over-broad activation increases the chance of unintended context switching, irrelevant guidance, or prompt-surface expansion if other content later relies on this skill being loaded only for specific travel, relocation, or city-information requests.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The flagged lines describe Overvecht using subjective safety framing such as higher petty crime, avoiding isolated areas at night, and contrasting this with residents feeling safe. In a relocation/neighborhood guidance skill, unsupported or imprecise safety characterizations can stigmatize a community, bias user decisions, and propagate potentially discriminatory housing guidance.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The file gives health-related advice about Seasonal Affective Disorder and recommends light therapy lamps and vitamin D supplements without any caution to consult a qualified professional. While the advice is common and low risk in a climate guide, it could still be inappropriate or unsafe for some users with underlying conditions, medication interactions, or mental health needs.

Natural-Language Policy Violations

Low

• Confidence: 80% confidence
• Finding: The language section strongly encourages learning and using Dutch, culminating in guidance to "Insist on Dutch (politely)." While cultural guidance is acceptable, this wording can be read as prescribing a specific language behavior rather than offering an explicit user choice or opt-in.

Natural-Language Policy Violations

Low

• Confidence: 79% confidence
• Finding: The document states 'Dutch language of instruction' as a default characteristic of primary schooling, which may be interpreted as prescribing a specific language without explicitly framing it as a system fact plus alternatives. Although international schools are discussed later, this line itself does not present language choice or opt-in context.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: Line L255 switches to Cyrillic text ('Борьба') within an otherwise English document, which introduces a language inconsistency without any opt-in or documented locale requirement. This can violate language/locale policy expectations for user-facing skill content.

Natural-Language Policy Violations

Low

• Confidence: 86% confidence
• Finding: Line L348 states 'Use English option — most government sites have it,' which prescribes a language preference rather than neutrally offering language choice. Under the policy, language constraints or preferences should be user-driven or explicitly optional, not implicitly directed.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: The phrase "need for BSN" introduces a locale-specific Dutch term without expansion or offering any language/locale adaptation. This can create a minor language/locale policy issue because the content assumes familiarity with local terminology rather than explicitly accommodating user understanding.

Natural-Language Policy Violations

Low

• Confidence: 80% confidence
• Finding: The phrase "Families wanting traditional Dutch feel" appears under "Not Great For," which presents a subjective household-based recommendation as a blanket exclusion. This is a natural-language quality concern because it steers a user group without clarifying that this is an opinionated preference rather than a user-selected criterion.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: The statement "Families (schools better elsewhere)" gives a categorical recommendation against a household type rather than framing it as a contextual consideration. This can be improved by qualifying the claim and presenting it as one factor among many, especially since school quality and family fit are nuanced topics.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: Line L358 says 'Start Dutch early,' which promotes use of a specific language as a general recommendation rather than offering language choice or framing it as optional based on user preference. Under the policy, forcing or pressuring a specific language without user opt-in can be a locale/language policy violation.

Static analysis

No suspicious patterns detected.