ClawHub
Back to skill

Security audit

K12 Teacher

Security checks for vulnerabilities and agentic risk

Overview

The teaching skill is mostly coherent, but its bundled GitHub workflow can execute commands embedded in pull-request titles.

Disable or repair the pull-request title workflow before enabling GitHub Actions; pass the title through an environment variable rather than inserting it into shell code. For tutoring, expect English-focused instructions, an incomplete curriculum knowledge base, and a placeholder updater. The skill does not confer educator licensure.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
.github/workflows/ci.yml
Finding

Attacker-controlled pull request title is interpolated directly into a shell script

Content
View full analysis

Trigger condition

A pull request targeting main triggers the workflow, subject to any applicable GitHub approval requirements for external contributors. The pr-title job then evaluates the pull request title inside its run script.

Impact

A title containing shell command substitution executes commands with the job's runner privileges. For example, the harmless title feat: $(printf audit-marker) causes printf to execute during assignment. The subsequent title-format check does not prevent execution because it runs afterward.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (8)

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · README_FOR_AI.md (reported line 548)May include surrounding context.

text
Step 6:  Write references/method-patterns.md (all code templates and instructional strategies)
Step 7:  Write SKILL.md (index and quick-reference, under 200 lines)
Step 8:  Write prompts/01-implement-method.md
Step 9:  Write prompts/02-robustness-checks.md
Step 10: Write tests/test-cases.md

The skill mandates English for runtime use and generated files without user opt-in.

Medium
Category
Output Handling
Confidence
99% confidence
Finding

The identity specifies English for both compilation and runtime, and constraint C-02 requires all source and documentation files to be in English. These mandatory language restrictions offer no user choice or documented justification; the narrow exception for glossary references does not provide language opt-in.

Content

No source excerpt is available for this finding.

L130 imposes an English-only content constraint without user opt-in or a documented justification.

Medium
Category
Output Handling
Confidence
98% confidence
Finding

The mandatory post-update validation explicitly includes an "English only" constraint. This enforces a specific natural language for knowledge-base content without offering a language choice or explaining why English is required.

Content

No source excerpt is available for this finding.

C-02 mandates English for all source and documentation files without user opt-in or a documented justification.

Medium
Category
Output Handling
Confidence
99% confidence
Finding

The constraint explicitly requires all source and documentation files to be in English. The G-04 checks at L258–L288 reinforce this restriction by warning about non-English content, without offering a language choice or explaining a locale-specific necessity.

Content

No source excerpt is available for this finding.

The contribution checklist mandates English for all content without language opt-in or a documented justification.

Low
Category
Output Handling
Confidence
98% confidence
Finding

The requirement that 'All content is in English (C-02)' explicitly imposes a specific natural language on contributions, including those made by AI contributors. The file provides neither a language choice nor a justification for this blanket restriction.

Content

No source excerpt is available for this finding.

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · LICENSE (reported line 596)May include surrounding context.

text
THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · LICENSE (reported line 608)May include surrounding context.

text
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF

The skill specifies English without offering user language choice or a documented justification.

Low
Category
Output Handling
Confidence
91% confidence
Finding

The identity settings fix the skill's language to English without user opt-in or an option to follow the learner's preferred language. The K–12 teaching scope does not document a reason for this language restriction.

Content

No source excerpt is available for this finding.