ClawHub
Back to skill

Security audit

anti-ai-writing-patterns

Security checks for vulnerabilities and agentic risk

Overview

This is a text-only writing-style skill, but it claims control over all agent output and may suppress useful limitation disclosures.

Install only if you want a strong global prose-style filter. Avoid using it in sessions that require exact wording, required templates, citations, safety disclosures, legal or compliance language, or clear statements about whether information is current or verified.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:3
Finding

Unbounded instructions alter output across unrelated contexts

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 3–10
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: Medium

Vulnerable snippet:

markdown
description: "Rules to avoid identifiable AI writing patterns. Apply to all text output regardless of model or context."
---

# Anti-AI Writing Patterns

Based on: https://en.wikipedia.org/wiki/Wikipedia:Signs_of_AI_writing

**Purpose:** Prevention, not detection. These are rules to follow while writing, not a rewriting guide for existing text. Apply to all output — messages, reports, summaries, emails, analyses — regardless of model or language.

Technical Analysis

The Skill explicitly applies its rules to all output, regardless of the active model, context, language, or task. This scope is broader than the stated purpose of avoiding certain writing patterns.

When loaded, these instructions can affect unrelated tasks that require exact wording, faithful quotations, mandated terminology, technical precision, or a prescribed output format. The document does not establish exceptions for higher-priority instructions, safety disclosures, code, legal language, quoted material, or user-requested terminology.

This is instruction hijacking because loading the Skill changes the Agent's behavior across the current session rather than limiting its effect to an explicit prose-editing task.

Attack Path

  1. A user or workflow loads the Skill for a writing-related task.
  2. The Agent processes the directives that claim authority over all subsequent output.
  3. The user later requests an unrelated report, exact quotation, technical response, or format-sensitive artifact.
  4. The Agent applies the Skill's replacement and deletion rules to that unrelated output.
  5. Required wording may be changed or omitted without an explicit request to edit it.

No persistence mechanism was found, so the demonstrated scope is limited to contexts in which ...[truncated 563 chars]

Remediation
View remediation

Remediation Suggestions

Restrict the Skill to explicit drafting or style-editing requests. Replace the global scope with language such as:

markdown
Apply these preferences only when the user explicitly requests prose drafting or style editing.
Do not apply them to code, exact quotations, required templates, legal or compliance text,
safety notices, capability disclosures, citations, or terminology the user asks to preserve.
Higher-priority instructions and factual accuracy always take precedence.

Add clear precedence rules stating that system and developer instructions, user-specified formats, factual accuracy, and necessary disclosures override style preferences. The Skill should also ask for confirmation before modifying exact quotations or required terminology.

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:127
Finding

Unconditional removal of capability and information-freshness disclosures

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 127–132
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: Medium

Vulnerable snippet:

markdown
### 4. Chatbot artifacts

Remove entirely — these are conversational tics from chat interfaces, not writing:

- Sycophantic openers: "Great question!", "Absolutely!", "Certainly!", "Of course!", "You're absolutely right!", "Excellent point!"
- Conversational closers: "I hope this helps!", "Feel free to reach out", "Let me know if you need anything else"
- Meta-narration: "In this article, we will explore...", "Let's dive in!", "Let me walk you through..."
- Cutoff disclaimers: "As of my last training update", "Based on available information", "I don't have access to real-time data"

Technical Analysis

The instruction classifies capability, provenance, and information-freshness disclosures as stylistic artifacts and directs the Agent to remove them entirely. Such disclosures are sometimes necessary to distinguish verified current information from knowledge that may be stale, incomplete, or unavailable without external tools.

The rule is unconditional. It does not distinguish empty boilerplate from a material limitation that affects the reliability of an answer. As a result, the Agent may suppress a valid warning instead of rewriting it concisely.

This falls under instruction hijacking because the Skill can override behavior needed for transparent communication about the Agent's access and evidentiary limits.

Attack Path

  1. The Skill is loaded into the Agent's active context.
  2. A user asks for current, real-time, or externally verified information.
  3. The Agent cannot access the required live source or cannot verify that its information is current.
  4. A truthful response would normally disclose that limitation.
  5. The Skill directs the Agent to remove the disclosure entirely.
  6. The remaining answer may appear curr ...[truncated 712 chars]
Remediation
View remediation

Remediation Suggestions

Replace the unconditional deletion rule with a distinction between irrelevant boilerplate and material disclosures:

markdown
Remove generic chatbot filler only when it adds no information. Preserve or rewrite any
disclosure that materially explains knowledge freshness, source availability, tool access,
uncertainty, or verification limits. State such limitations briefly and specifically.

Require the Agent to retain disclosures when:

  • the user requests current or real-time information;
  • external verification is unavailable;
  • the answer relies on potentially stale knowledge;
  • provenance or uncertainty changes how the response should be interpreted; or
  • a higher-priority instruction requires transparency.

Prefer a precise statement such as “I cannot verify the current value without live data access” rather than suppressing the limitation.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly says its writing rules apply to all output regardless of model, language, or context, which attempts to override normal user- and task-specific behavior. That creates a prompt-scope violation: the skill can silently reshape security analyses, compliance text, or other high-stakes responses even when the user did not request this style layer.

Content

No source excerpt is available for this finding.