ClawHub
Back to skill

Security audit

Mindfulness Meditation

Security checks for vulnerabilities and agentic risk

Overview

This is a simple meditation guidance skill with no executable code, network behavior, credential use, or hidden persistence.

Review the broad "be present" trigger if accidental activation would be annoying. Otherwise, the artifact is purpose-aligned; any real reminders or logs should remain local and user-controlled as the skill text claims.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Anti-Refusal Statement

High
Category
Anti-Refusal
Content
**Walking** — Meditate while moving. Synchronize breath with steps and notice your surroundings with full attention.

**Open Awareness** — Observe thoughts and sensations without judgment. Develop witness consciousness and mental spaciousness.

## Session Lengths
Confidence
80% confidence
Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Anti-Refusal Statement

High
Category
Anti-Refusal
Content
**Walking** — Meditate while moving. Synchronize breath with steps and notice your surroundings with full attention.

**Open Awareness** — Observe thoughts and sensations without judgment. Develop witness consciousness and mental spaciousness.

## Session Lengths
Confidence
80% confidence
Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Vague Triggers

Medium
Confidence
92% confidence
Finding
The trigger phrase "be present" is broad, natural language that can easily occur in ordinary conversation outside an explicit request to use this skill. Overly generic triggers can cause unintended activation, which may lead to confusion, context hijacking, or accidental invocation of skill behavior when the user did not intend it.

Static analysis

No suspicious patterns detected.