ClawHub
Back to skill

Security audit

JEV Gated Agent Workflow

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only skill for designing a constrained decision gate, with safeguards that are disclosed and aligned with its purpose.

Before installing, verify that your implementation uses a narrow allowlist, short-lived one-time permits, redacted logs, and explicit confirmation for any irreversible or high-impact write action your own policy requires. Do not store JEV keys, real IDs, logs, or local policy files in the skill package.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md
## Standard workflow

1. Identify the high-cost or sensitive action and the small set of allowed branches.
2. Capture the current natural-language request and bind it to the session without asking the user for an internal identifier.
3. Call the local router; the router calls TypeSafe JEV with only the request and branch descriptions.
4. Validate the response locally: choice is allowlisted, confidence meets the configured threshold, returned target matches the allowlist, and no confirmation flag is set.
5. Mint a one-time permit scoped to the exact tool and target. If any check fails, explain the denial and stop before the protected tool.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

The workflow explicitly accepts execution when 'no confirmation flag is set' and then mints a permit for the protected tool, meaning sensitive actions may proceed without an explicit user confirmation step. Although the design includes strong compensating controls like allowlists, local validation, and default-deny, the absence of mandatory confirmation for high-impact branches increases the chance of unintended or misrouted actions if intent classification is wrong.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md
1. Identify the high-cost or sensitive action and the small set of allowed branches.
2. Capture the current natural-language request and bind it to the session without asking the user for an internal identifier.
3. Call the local router; the router calls TypeSafe JEV with only the request and branch descriptions.
4. Validate the response locally: choice is allowlisted, confidence meets the configured threshold, returned target matches the allowlist, and no confirmation flag is set.
5. Mint a one-time permit scoped to the exact tool and target. If any check fails, explain the denial and stop before the protected tool.
6. Invoke the minimum tool call. Inject the internal target from the allowlist; do not pass through a user-supplied target.
7. Return a concise result, record only redacted diagnostics, and expire the permit.