ClawHub
Back to skill

Security audit

AI Proposal Generator

Security checks for vulnerabilities and agentic risk

Overview

This proposal generator is coherent, but it should be reviewed because it can automatically read client notes and global memory and generate active HTML without defined sanitization.

Before installing, be comfortable with the skill reading proposal inputs from meeting-notes/, proposals/SERVICES.md, and MEMORY.md. Ask the agent to show the exact source files it will use before generating a proposal, avoid using untrusted meeting notes or links without sanitization, and review generated HTML carefully before sending it to clients.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:124
Finding

Automatic Access to Global Agent Memory Violates Least Privilege

Content
View full analysis
Remediation
View remediation
/context.md`, instead of global memory. 4. Require the user to identify the exact meeting-note or client-context file to be used. 5. Apply strict path allowlisting and prohibit traversal outside approved proposal and client directories. 6. Extract only fields required for the proposal, such as scope, timeline, budget, and named decision-makers. 7. Add a pre-generation review showing every source file that will be used. 8. Prevent information from unrelated records from entering drafts or finalized proposals. 9. Record memory access in an audit log containing the authorized client, source path, purpose, and user approval. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
assets/proposal-template.html:315
Finding

Unescaped Proposal Data Is Inserted into Active HTML, URL, Attribute, and CSS Contexts

Content
View full analysis
{{#if logo}} {{company_name}} {{/if}}

{{title}}

Prepared for {{client_name}}

{{date}} • Valid until {{valid_until}}

{{content}}

{{company_name}} — {{tagline}}

{{contact_info}}

``` ### Technical Analysis The template uses raw placeholders in contexts that require different security controls: - `{{content}}` is ...[truncated 2633 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly instructs the agent to search meeting notes, check MEMORY.md for client history, and load pricing files, but the skill description does not warn users that client-related files and historical notes may be accessed automatically. This creates a transparency and consent problem: users may trigger proposal generation without realizing sensitive internal or client data will be read and incorporated into outputs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The HTML root sets lang="en", which forces the document language to English. Under the policy rule for natural-language constraints, this is a locale choice with no visible user opt-in or justification in the file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The document declares lang="en", which hard-codes English as the page language. Under the policy criteria, forcing a specific language without user opt-in or a documented justification can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The document declares lang="en", which hard-codes English as the page language. Under the policy, locale-specific behavior should either offer user opt-in/choice or be clearly justified as region-specific; neither is present in this file.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.