ClawHub
Back to skill

Security audit

Meta Skill Optimizer

Security checks for vulnerabilities and agentic risk

Overview

This skill is not clearly malicious, but it is a Review item because it encourages broad recording of prompts, task context, errors, tool parameters, and results into persistent plaintext files.

Install only if you are comfortable with this skill keeping local learning records. Avoid feeding it secrets, credentials, private file contents, customer data, or sensitive prompts unless you first add redaction, retention limits, restricted file permissions, and a way to disable or clear persistence. Review and pin the installation dependencies before running the documented pip command.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:51
Finding

Unnecessary and Unpinned Third-Party Package Installation

Content
View full analysis
Remediation
View remediation
``` ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
meta_optimizer.py:47
Finding

Potentially Sensitive Execution Records Stored in Predictable Plaintext Files

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (15)

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · meta_optimizer.py (reported line 313)May include surrounding context.

python
elif 'summarize' in prompt.lower():
            prompt += " Provide structured bullet points with key takeaways."
        
        return prompt
    
    def _add_context(self, prompt: str) -> str:
        """Add context to prompt"""

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · meta_optimizer.py (reported line 318)May include surrounding context.

python
elif 'summarize' in prompt.lower():
            prompt += " Provide structured bullet points with key takeaways."
        
        return prompt
    
    def _add_context(self, prompt: str) -> str:
        """Add context to prompt"""

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · meta_optimizer.py (reported line 323)May include surrounding context.

python
elif 'summarize' in prompt.lower():
            prompt += " Provide structured bullet points with key takeaways."
        
        return prompt
    
    def _add_context(self, prompt: str) -> str:
        """Add context to prompt"""

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding

The skill advertises behavior that can read and write data through optimizer integrations and knowledge export, yet it declares no explicit tool scope or permissions. In an agent ecosystem, missing scope boundaries increases the chance that a self-optimizing skill will access or persist more data than intended, especially when combined with auto-recording and evolution features.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The combination of automatic execution recording and the instruction to record everything creates a direct natural-language pathway to broad data collection. In context, this meta-skill is designed to observe many tasks across tools and skills, so it could aggregate large amounts of user content, operational context, and potentially credentials into a knowledge base or exported experience set.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The guidance to 'Record Everything' promotes blanket retention of execution data without any privacy, minimization, or sensitivity warning. Because execution records can contain prompts, user inputs, files, secrets, and contextual metadata, this creates a realistic risk of collecting and storing sensitive information unnecessarily.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill persistently writes its knowledge base to a local JSON file under the user’s home directory without any disclosure, consent, retention policy, or minimization. Because the stored structure later contains task details, contexts, prompts, outcomes, and errors, sensitive user and workflow data can be silently retained and exposed to other local users, backups, or later components.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

record_success stores raw task, approach, context, and outcome data to disk, which may include secrets, proprietary prompts, personal information, or operational details. In an AI skill that learns from arbitrary user interactions, silent persistence materially increases privacy and cross-session data leakage risk.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The optimizer stores raw natural-language task, approach, context, and outcome content, creating a durable repository of potentially sensitive interaction history. Such retained text can later be surfaced through analytics, examples, exports, or debugging and may disclose information far beyond what is needed for optimization.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

record_failure persists arbitrary error strings, lessons, task descriptions, and context to disk without disclosure. Error messages often contain stack traces, file paths, tokens, query fragments, or internal system details, so retaining them raw creates a meaningful confidentiality risk.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

optimize_prompt stores full original prompts in effective/ineffective lists, directly retaining user or system prompt contents that may include credentials, internal instructions, personal data, or sensitive business logic. Because the component is designed to reuse history, prompt contents can later be resurfaced or propagated unintentionally.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

generate_examples reuses prior successful approaches from historical records and returns them as examples for future tasks. If those approaches contain sensitive instructions, proprietary methods, or user data, the function can replay prior content into unrelated future contexts, causing cross-session disclosure.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The manifest describes a skill that learns from feedback, tunes prompts, and optimizes tool usage patterns, but this method goes beyond meta-optimization by prescribing concrete tools for disparate domains such as research, coding, and especially trading. Recommending a 'quant-trading-api' is not an obvious requirement of a self-improving optimizer and introduces a capability outside the stated purpose.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

export_knowledge and merge_experiences allow accumulated historical content to be moved across components or instances without validation, minimization, or trust-boundary controls. This makes stored sensitive interaction data more likely to spread beyond its original context and increases the blast radius of any privacy failure.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The docstring for '_optimize_params_analysis' says it analyzes parameter history and optimizes, but in the insufficient-data branch it returns 'params', which is not defined in this function. This is an active contradiction between the documented intent and the actual behavior, which would raise an error instead of producing a recommendation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.