ClawHub
Back to skill

Security audit

Plain Writing

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent local writing and prose-linting helper, with no evidence of hidden data access, persistence, exfiltration, or deceptive behavior.

Install this if you want a local plain-writing assistant that can lint drafts and compare edits. Run its scripts only on drafts or source files you intend to expose to the agent, especially when using globs, because linter output can include excerpts from those files.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (9)

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
85% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 170)May include surrounding context.

md
`--protected-token TOKEN`. Add `--protected-count` only when repetition count
is itself meaningful. Use `--fail-on-structural-expansion` only when the task
forbids more structural units.
Structural and lint deltas are review evidence. They do not judge truth,
completeness, authorship, or quality.

If tools are unavailable, perform both reviews by hand. Never claim that a

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/lint_prose.py (reported line 885)May include surrounding context.

python
) -> None:
        severity = severity_for(mode, code)
        if severity == "off":
            return
        rule = RULES[code]
        line, column = location(starts, start)
        message = rule.title + (f": {detail}" if detail else "")

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill explicitly instructs the agent to read reference files, write temporary drafts, and invoke local Python scripts, but it declares no tool scope or permissions boundary. That creates an authorization gap where a host may expose broader file or shell access than the skill actually needs, increasing the risk of unintended file access or command execution if the skill is reused in a less constrained environment.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_lint_prose.py (reported line 220)May include surrounding context.

python
def run_cli(
        self, *args: str, input_text: str | None = None
    ) -> subprocess.CompletedProcess[str]:
        return subprocess.run(
            [sys.executable, str(SCRIPT), *args],
            input=input_text,
            text=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_lint_prose.py (reported line 311)May include surrounding context.

python
)

    def test_eval_suite_passes(self) -> None:
        process = subprocess.run(
            [sys.executable, str(EVAL_SCRIPT), "--format", "json"],
            text=True,
            capture_output=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_score_delta.py (reported line 103)May include surrounding context.

python
"# Update\n\n- Alpha\n- Bravo\n",
        )
        self.addCleanup(directory.cleanup)
        process = subprocess.run(
            [
                sys.executable,
                str(SCRIPT),

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_score_delta.py (reported line 169)May include surrounding context.

python
"It is worth noting that this robust tool can leverage data.",
        )
        self.addCleanup(directory.cleanup)
        process = subprocess.run(
            [
                sys.executable,
                str(SCRIPT),

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_score_delta.py (reported line 190)May include surrounding context.

python
self.assertTrue(report["mechanical_regression"])

    def test_missing_input_returns_usage_error(self) -> None:
        process = subprocess.run(
            [sys.executable, str(SCRIPT), "/missing-before", "/missing-after"],
            text=True,
            capture_output=True,

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

The instruction 'Choose one language mode. Default to technical' imposes a specific language/style mode unless the user explicitly requests otherwise. This can be a natural-language policy concern when users are not offered an upfront choice, especially because only the 'natural' mode explicitly requires user request.

Content

No source excerpt is available for this finding.