ClawHub
Back to skill

Security audit

Self Review

Security checks for vulnerabilities and agentic risk

Overview

This skill is a simple local output-quality checker with some transparency and language-scope limitations, but no evidence of hidden persistence, data access, exfiltration, or destructive behavior.

Install only if you want a local quality gate that may reject short or weakly structured responses. If you wire it into an agent pipeline, make rejection and regeneration behavior visible and controllable, and be aware the current heuristic favors Chinese and English action wording.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

md
"name": "self-review",
  "version": "1.0.0",
  "description": "Quality gate: Before sending final response, run self-review to check clarity, token efficiency, actionability. Returns exit code 0 if approved, 1 if needs improvement.",
  "author": "dvinci达芬奇 (self-evolved)",
  "tags": ["quality", "self-improvement", "automation"],
  "prompt": "You are a quality critic. Review the following agent output and score it 1-10 on:\n\n1. Clarity: Is it easy to understand?\n2. Token Efficiency: Is it concise without losing meaning?\n3. Actionability: Does it provide clear next steps?\n4. Factual Accuracy: Any obvious errors?\n\nOutput format: JSON with {score: <number>, feedback: \"brief suggestions\"}\n\nIf overall score < 7, suggest specific improvements.",
  "command": "node skills/self-review/index.js",

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · skill.json (reported line 5)May include surrounding context.

json
"name": "self-review",
  "version": "1.0.0",
  "description": "Quality gate: Before sending final response, run self-review to check clarity, token efficiency, actionability. Returns exit code 0 if approved, 1 if needs improvement.",
  "author": "dvinci达芬奇 (self-evolved)",
  "tags": ["quality", "self-improvement", "automation"],
  "prompt": "You are a quality critic. Review the following agent output and score it 1-10 on:\n\n1. Clarity: Is it easy to understand?\n2. Token Efficiency: Is it concise without losing meaning?\n3. Actionability: Does it provide clear next steps?\n4. Factual Accuracy: Any obvious errors?\n\nOutput format: JSON with {score: <number>, feedback: \"brief suggestions\"}\n\nIf overall score < 7, suggest specific improvements.",
  "command": "node skills/self-review/index.js",

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README title and all descriptive content are written in Chinese, and the scoring rules explicitly check for Chinese action words such as “应该/需要/建议/请”. This indicates a language-specific behavior or expectation, but the file does not offer an opt-in language choice or explain that the skill is intentionally limited to a Chinese-language context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README explicitly describes calling the self-review gate on agent responses before they are sent and notes auto-regeneration on rejection, but it does not disclose that user-facing content may be silently rewritten. That creates a transparency and integrity risk: the final message may differ from the model's original output in ways users and operators cannot detect or audit.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The natural-language heuristic only recognizes action-oriented text via a hardcoded regex containing Chinese and English terms like 'please', 'should', '建议', and '需要'. This can penalize outputs written in other languages, effectively imposing a language preference without documenting user choice or locale scope.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.