ClawHub
Back to skill

Security audit

Secretary Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local planning assistant that saves user-created plans and prints scheduling payloads, with no evidence of hidden execution, exfiltration, or persistence beyond disclosed plan files.

Review plan files and scheduling JSON before sharing or importing them into any automation tool, because they may contain personal goals, timelines, and task context. Non-Chinese users should also note that key prompts are Chinese-first.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (7)

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The instructions require asking specific Chinese phrases such as "现在清晰了吗？" and expecting "清楚了" as the user's signal. This imposes a language/locale requirement without opt-in, which is a natural-language policy violation under the stated rules.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill explicitly generates a JSON payload containing user goal details and current task context 'ready to be injected into an automation engine,' but it provides no consent step, privacy notice, or data-minimization guidance. This can cause unintended disclosure of potentially sensitive planning data to external systems, logs, or schedulers, especially because long-term goals may reveal health, career, financial, or personal information.

Natural-Language Policy Violations

Medium
Confidence
97% confidence
Finding
This code presents core interactive prompts and readiness keywords in Chinese, including required completion responses like "清楚了", while the rest of the CLI is otherwise English-oriented. That imposes a language choice on users without offering a locale option or documenting that the tool is intended only for Chinese-speaking users.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The de-ambiguation question bank is entirely hard-coded in Chinese, with no indication that the user can choose another language or locale. This creates a natural-language policy concern because the skill appears to require a specific language rather than offering an opt-in or alternative.

Tainted flow: 'text' from pathlib.Path.read_text (line 104, file read) → pathlib.Path.write_text (file write)

Medium
Category
Data Flow
Content
text = text.replace(
                "\n---\n", f"\n{marker}\n\n{entry}\n\n---\n", 1
            )
            path.write_text(text, encoding="utf-8")

    # ── path resolution ────────────────────────────────────────────────
Confidence
65% confidence
Finding
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Intent-Code Divergence

Low
Confidence
96% confidence
Finding
The module docstring says '/schedule --freq F — map tasks onto a timeline, output cron config'. In implementation, cmd_schedule serializes scheduled jobs with self.scheduler.to_json(job) and prints json.dumps(jobs), with no code that writes a cron file, emits crontab syntax, or configures the system scheduler.

Natural-Language Policy Violations

Low
Confidence
93% confidence
Finding
The file hard-codes a Chinese/English heading marker for the alignment log, which assumes a specific locale in generated content. The templates also consistently emit Chinese labels and a Chinese instruction string, but the marker at L082 is the clearest enforcement point in logic because parsing/appending depends on that exact locale-specific text.

Static analysis

No suspicious patterns detected.