ClawHub
Back to skill

Security audit

Agent Master Skills Clawhub Pkg

Security checks for vulnerabilities and agentic risk

Overview

The skill received a suspicious verdict because its README includes broad instructions to invoke other skills for unrelated work, and its stated purpose does not disclose that it installs an external package.

Consider avoiding installation until the broad invocation instructions and the undisclosed package installation have been clarified. The scanners inspected all three reported components, but the contents and subsequent behavior of the installed package are unknown.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · README.md (reported line 65)May include surrounding context.

md
| **Codex CLI** / Replit Agent | `.agents/skills/` | `~/.agents/skills/` |
| **Cursor** | `.cursor/skills/` | `~/.cursor/skills/` |
| **Gemini CLI** | `.gemini/skills/` | — |
| **Google Antigravity** | `.agent/skills/` | `~/.gemini/config/skills/` |
| **Hermes Agent** | `.hermes/skills/` | `${HERMES_HOME:-$HOME/.hermes}/skills/` |
| **Grok Build** | `.grok/skills/` | `~/.grok/skills/` |
| **Devin** | `.devin/skills/` | `${XDG_CONFIG_HOME:-$HOME/.config}/devin/skills/` |

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
90% confidence
Finding

The description presents a skill collection, but the supplied executable content performs package installation rather than listing or providing that collection. Installation is an undeclared capability. The supplied chunk does not establish what the installed package contains or what it subsequently does.

Content

No source excerpt is available for this finding.

The byterover listing requires invocation before 'any work,' without limiting activation to knowledge-management tasks.

Medium
Category
Trigger Abuse
Confidence
96% confidence
Finding

The byterover description makes its use mandatory before any work, allowing catalog content to redirect unrelated tasks toward a particular skill. Its placement in a README index reduces the likelihood of execution, but an agent treating skill descriptions as operational guidance could perform unnecessary context gathering; no actual data disclosure is established here.

Content

No source excerpt is available for this finding.

The using-superpowers listing activates on the start of any conversation, regardless of user intent.

Medium
Category
Trigger Abuse
Confidence
95% confidence
Finding

The using-superpowers listing claims activation at the start of every conversation and requires skill-tool use without reference to the user's task. This creates an overbroad workflow-redirection risk if an agent promotes catalog descriptions into instructions, although the README alone does not demonstrate harmful tool execution.

Content

No source excerpt is available for this finding.