ClawHub
Back to skill

Security audit

Skill Distill

Security checks for vulnerabilities and agentic risk

Overview

This skill manages local skill files and includes powerful maintenance actions, but the artifacts disclose that purpose and require user approval before persistent changes.

Install only if you want an assistant to inspect and help maintain your local skills. Review proposed diffs carefully before approving changes, especially when scripts, external searches, installs, or shared/team skills are involved.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
83% confidence
Finding
The skill's stated purpose is to merge overlapping skills, but the workflow expands into running post-generation scoring, orchestration, and evaluation tools. This scope creep increases the attack surface and can cause an agent to perform unexpected external actions under the guise of a documentation/distillation task, especially if downstream tools have filesystem or execution privileges.

Context-Inappropriate Capability

High
Confidence
95% confidence
Finding
The skill instructs execution of external Python scripts from local skill directories, which is a material capability escalation beyond text distillation. If an agent follows these instructions automatically, a malicious or tampered local environment could execute arbitrary code, modify files, or exfiltrate data through those scripts.

Vague Triggers

Medium
Confidence
81% confidence
Finding
The trigger set includes broad patterns like 'merge.*skill' and 'consolidate.*skill', which can match many benign requests and cause this skill to load unexpectedly. Because this skill contains instructions to generate files and invoke external validation tooling, overbroad routing makes accidental activation more dangerous than a normal false route.

Static analysis

No suspicious patterns detected.