ClawHub
Back to skill

Security audit

llm-wiki

Security checks for vulnerabilities and agentic risk

Overview

This skill is a plain Markdown guide for having an agent maintain an Obsidian-style wiki, with its file edits and persistence disclosed as the core purpose.

Install this only for vaults where you are comfortable with an agent reading source material and creating or revising generated wiki pages. Define raw-source and generated-wiki directories, use version control or backups before batch ingest or lint passes, and avoid storing secrets or sensitive logs unless you have a retention plan.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill explicitly promotes a workflow where the LLM 'owns' the wiki layer and may create or update many markdown files during ingest and maintenance, but the skill metadata and instructions do not foreground this as an operational warning. In a markdown vault such behavior can cause unintended bulk edits, overwrite user content, or create trust issues if users do not realize the extent of autonomous file modification.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill normalizes persistent retention of ingests, queries, analyses, and logs inside the wiki without any privacy boundary, redaction guidance, or consent checkpoint. In this context, the skill is specifically designed to accumulate user-provided knowledge over time, so storing conversation-derived content and chronological logs can expose sensitive personal, research, or business information well beyond the original chat session.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The skill suggests using CLI tools and states the LLM can 'shell out' to them, but it does not warn users that this implies subprocess execution on the local system. Even when the named tools are legitimate, invoking local commands expands the attack surface and can lead to unexpected system interactions if the user has not explicitly consented.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The 'Contact Us' section switches to Chinese-only text, which imposes a specific language for part of the skill content without user opt-in. This is a natural-language locale issue because the document otherwise uses English and does not explain that contact information is region- or language-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.