ClawHub
Back to skill

Security audit

self-improving-negotiation

Security checks across malware telemetry and agentic risk

Overview

This skill is a local negotiation-learning logger with disclosed, opt-in reminders and dry-run-by-default skill extraction.

Install only if you want local negotiation process logs and reminders. Keep .learnings private or reviewed before committing, enable hooks only at the project level, and review any generated SKILL.md diff before using or publishing it.

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill includes documented network-capable actions (`clawdhub install` and `git clone`) but does not declare permissions or a constrained trust model for when network access is allowed. Even though these actions are framed as optional and user-initiated, undeclared network capability increases supply-chain and exfiltration risk because operators may invoke remote installs from within a skill workflow without an explicit permission boundary.

Self-Modification

High
Category
Rogue Agent
Content
- execute legal/financial approvals
- finalize agreements
- run network calls unless you choose ClawHub install or `git clone`
- write skill files unless you run `extract-skill.sh --write`

Always require explicit human approval for high-impact concessions and for final terms.
Confidence
84% confidence
Finding
The skill explicitly contemplates writing skill files via `extract-skill.sh --write`, which is a self-modification pathway. Although the document repeatedly requires explicit user approval and says dry-run is default, any workflow that can generate or overwrite future agent instructions can be abused to persist unsafe behavior, especially if review is skipped or automated.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.