ClawHub
Back to skill

Security audit

Negotiation

Security checks for vulnerabilities and agentic risk

Overview

This is a plain negotiation-advice skill with no executable code, hidden authority, persistence, or data access.

Installers should understand this skill provides generic negotiation and contract-term guidance, not professional legal or financial advice. From a security perspective, it is low risk because it is static Markdown and does not ask for access to local files, credentials, accounts, tools, or network resources.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
55% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

md
Before proposing anything, make sure you understand their constraints and priorities. Ask open-ended questions: "What's most important to you in this decision?" "What does your timeline look like?" "What would make this an easy yes for you?"

**2. State your position clearly and with confidence**
Don't apologize for your price. Don't hedge. Say it clearly: "Based on the scope we discussed, my price is $X. Here's what that includes and why."

**3. Trade concessions, don't give them away**
Every concession you make should come with something in return. "I can drop the price by $500 if we move the timeline up by one week" or "I can include the extra feature if you commit to a 6-month contract instead of 3."

Static analysis

No suspicious patterns detected.