ClawHub
Back to skill

Security audit

human-writing

Security checks for vulnerabilities and agentic risk

Overview

This is a narrow writing-assistance skill with an optional local validation script and no evidence of hidden data access, persistence, exfiltration, or unsafe automation.

Before installing, understand that the skill will influence how the agent drafts or edits public prose and may preserve roughness, unresolved tension, and personal voice instead of polishing everything. The bundled validator is benign local development tooling, but it is not needed for normal writing use.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared purpose is a writing-assistance skill focused on editing prose style. The supplied code does not draft or review writing content; instead, it validates the layout and contents of a skill repository and scans files for compliance and privacy issues. While some checks reference phrases related to the writing skill, the primary behavior is repo auditing/linting, which is materially different from the declared end-user function.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

md
4. Did it replace the writer's real nouns and judgement with generic stand-ins?
5. Did it remove useful roughness, side threads, contradiction, or unresolved tension?

If yes to any of these, pause and rewrite before sending. Do not ask the user to catch it.

## Human Voice Rules