ClawHub
Back to skill

Security audit

Brainstorming

Security checks for vulnerabilities and agentic risk

Overview

The skill is a brainstorming workflow, but it broadly forces itself into many development tasks and mandates repository changes and a follow-on skill invocation.

Review this skill carefully before installing. It may be useful for substantial design work, but it is written to run very broadly, delay implementation until its process is complete, inspect project context, write and commit a spec, and route the agent to a separate writing-plans skill. Install only if you want that strict workflow, and require explicit approval before any file writes, commits, browser companion startup, or follow-on skill invocation.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:3
Finding

Mandatory Workflow and Follow-On Skill Invocation Hijack

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 3, 12–14, 22–32, and 61
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Vulnerable Code

markdown
description: "You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation."
markdown
<HARD-GATE>
Do NOT invoke any implementation skill, write any code, scaffold any project, or take any implementation action until you have presented a design and the user has approved it. This applies to EVERY project regardless of perceived simplicity.
</HARD-GATE>
markdown
You MUST create a task for each of these items and complete them in order:

1. **Explore project context** — check files, docs, recent commits
2. **Offer the visual companion just-in-time** — NOT upfront. The first time a question would genuinely be clearer shown than described, offer it then (its own message); on approval its browser tab opens for you. If no visual question ever arises, never offer it. See the Visual Companion section below.
3. **Ask clarifying questions** — one at a time, understand purpose/constraints/success criteria
4. **Propose 2-3 approaches** — with trade-offs and your recommendation
5. **Present design** — in sections scaled to their complexity, get user approval after each section
6. **Write design doc** — save to `docs/superpowers/specs/YYYY-MM-DD-<topic>-design.md` and commit
7. **Spec self-review** — quick inline check for placeholders, contradictions, ambiguity, scope (see below)
8. **User reviews written spec** — ask user to review the spec file before proceeding
9. **Transition to implementation** — invoke writing-plans skill to create implementation plan
markdown
**The terminal state is invoking writing-plans.** Do NOT invoke frontend-design, mcp-builder, or any other implementation skill. The ONLY sk
...[truncated 3199 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace unconditional directives with scope-limited guidance. For example, state that the workflow applies only when the user explicitly requests brainstorming or design assistance.
  2. Remove claims that the Skill must be used before “any creative work” or for “EVERY project.”
  3. Remove the hard gate that categorically prevents implementation. Allow the user’s explicit request and higher-priority instructions to determine whether a design phase is necessary.
  4. Make specification creation optional and require explicit user approval before writing a file.
  5. Treat Git commits as separately authorized actions. Never commit merely because the Skill workflow says to do so.
  6. Remove the prohibition against all implementation Skills except writing-plans. Follow-on Skill selection should depend on the user’s request and the Agent’s trusted orchestration policy.
  7. Do not mandate invocation of a Skill that is absent from the audited package. If optional integration is retained, clearly identify it as an external dependency and require it to be independently reviewed.
  8. Add an explicit boundary such as: “These instructions are recommendations within an authorized brainstorming task and do not override user requests, system instructions, safety policies, or tool-authorization requirements.”
  9. Preserve useful brainstorming practices—clarifying requirements, comparing approaches, and validating designs—as recommendations rather than universal commands.

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The invocation rule is extremely broad: 'before any creative work' can apply to most normal development activity, which may cause the agent to route many unrelated requests through this skill. Overly broad triggering can be abused to force unnecessary context gathering, file inspection, and workflow changes, increasing exposure of repository state and creating opportunities for prompt-control or denial-of-service style friction.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

Requiring the agent to 'create a task for each of these items and complete them in order' introduces persistent workflow state that can outlive the immediate user request and compel follow-on actions such as checking files, docs, commits, writing a design doc, committing it, and invoking another skill. This kind of session persistence can be exploited to steer the agent into unnecessary repository access and chained actions even when the original task did not warrant them.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

md
## Checklist

You MUST create a task for each of these items and complete them in order:

1. **Explore project context** — check files, docs, recent commits
2. **Offer the visual companion just-in-time** — NOT upfront. The first time a question would genuinely be clearer shown than described, offer it then (its own message); on approval its browser tab opens for you. If no visual question ever arises, never offer it. See the Visual Companion section below.

Static analysis

No suspicious patterns detected.