ClawHub
Back to skill

Security audit

Product Description Writer

Security checks for vulnerabilities and agentic risk

Overview

This is a markdown-only ecommerce copywriting skill with no hidden execution, persistence, or sensitive data access.

Installers should expect this skill to help draft and optimize product listings from product details they provide. Review generated SEO claims, marketplace policy guidance, and any language/localization suggestions before publishing, especially where platform rules or product claims must be accurate.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The description says to use the skill for broad situations like creating new listings, rewriting underperforming descriptions, adapting descriptions across platforms, or generating batch descriptions. For a markdown skill file, this is an ambiguous activation scope because it describes many common ecommerce-writing scenarios but does not provide explicit trigger phrases, constraints, or negative examples to reduce unintended invocation.

Content

No source excerpt is available for this finding.

File System Enumeration

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SKILL.md (reported line 291)May include surrounding context.

md
**Long Description:**
<h3>Before Everthread</h3>
Your sweater drawer is a compromise. Cheap knits that pill after three wears. "Dry clean only" wool that spends more time at the cleaners than on your body. Synthetic blends that trap heat in the office and leave you shivering on the walk home.

<h3>After Everthread</h3>
One sweater that actually works. Soft 17.5-micron extra-fine merino that regulates your temperature naturally — warm when you need warmth, breathable when you don't. Machine washable because life is too short for hand-wash-only labels. And a clean crewneck silhouette that works with your entire closet, not just one outfit.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The guidance says to 'Include Spanish translations of key terms if selling in US market,' which imposes a specific language/locale behavior as a default recommendation. This is a natural-language locale policy issue because it does not present language inclusion as optional, user-selected, or justified by a clearly region-specific requirement.

Content

No source excerpt is available for this finding.

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 240)May include surrounding context.

md
2. HomeChef Essentials 4-Piece Silicone Spatula Set — 600°F Heat Resistant, Seamless One-Piece Construction, BPA-Free Kitchen Utensils Set

**Bullet Points:**
- **Cook with confidence at any temperature** — Heat resistant to 600°F, these silicone spatulas handle everything from delicate sauces to high-heat searing without melting, warping, or releasing harmful chemicals. BPA-free and FDA-approved food-grade silicone.
- **No seams means no trapped food or bacteria** — Unlike spatulas with separate heads and handles, our one-piece seamless construction eliminates the gap where food particles hide. Cleaner cooking, every time.
- **Four sizes for every cooking task** — Includes large turner (12"), standard spatula (10"), small scraper (8.5"), and mini spatula (6") so you always have the right tool. From flipping pancakes to scraping the last bit from a jar.
- **Dishwasher safe and built to last** — Toss them in the top rack after cooking. The reinforced silicone core maintains shape and flexibility through hundreds of wash cycles without cracking or fading.

Static analysis

No suspicious patterns detected.