ClawHub
Back to skill

Security audit

Agent Orchestrator 0.1.0

Security checks for vulnerabilities and agentic risk

Overview

This skill is not malicious, but it needs review because it can spawn autonomous sub-agents and create, archive, or clean up workspace files from broad trigger phrases.

Install only if you intentionally want a skill that can coordinate multiple autonomous agents and create or manage workspace files. Use it on tasks where multi-agent execution is clearly desired, choose a contained workspace path, and review archive or cleanup actions before letting it run.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

Memory Manipulation

High
Category
Memory Poisoning
Content
# Task: {TASK_NAME}

## Objective
{Clear statement of what needs to be accomplished}

## Context
{Background information relevant to the task}
Confidence
80% confidence
Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding
Suspicious Unicode normalization or mixed-script content

Vague Triggers

Medium
Confidence
96% confidence
Finding
The mandatory trigger list includes broad phrases such as 'orchestrate', 'sub-agents', 'parallel agents', and 'delegate tasks', which could match many benign user requests and cause this high-privilege orchestration skill to activate unexpectedly. In context, this is more dangerous because the skill can spawn agents, generate files, and coordinate autonomous actions, so accidental activation expands operational scope without clear user intent.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill instructs the agent to create workspaces, generate SKILL.md files, write inbox/outbox artifacts, update status files, archive data, and clean up temporary files, but it does not require explicit user disclosure or consent for those filesystem modifications. This is dangerous because the orchestrator is designed to perform broad autonomous file operations across multiple sub-agent directories, increasing the chance of unintended data creation, persistence, overwrite, or deletion.