ClawHub
Back to skill

Security audit

Counselor

Security checks for vulnerabilities and agentic risk

Overview

The skill is a Markdown-only counseling-style decision support guide with no hidden tools, persistence, data access, or executable behavior.

Use this as a general reflection and decision-support aid, not as a substitute for licensed counseling or professional legal, medical, financial, or emergency help. The main thing to watch is broad triggering on personal advice requests, not hidden access or code execution.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
80% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

md
- User needs help processing a major life change

## How to Use
1. Create a safe space: listen first without judgment
2. Ask clarifying questions to understand the full situation
3. Help the user articulate their values, priorities, and goals
4. Offer multiple perspectives and frameworks for the decision

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The activation criteria are broad and map to very common help-seeking language such as difficult decisions, life challenges, and requests for advice. This can cause the skill to trigger in many ambiguous situations, including sensitive domains where a generic counseling persona may inappropriately engage instead of routing to safer, domain-specific handling.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.