ClawHub
Back to skill

Security audit

Skill Grep

Security checks for vulnerabilities and agentic risk

Overview

This skill is a Review item because it sends user queries and feedback to a third-party service and promotes unpinned install commands without enough consent, scoping, or provenance controls.

Install only if you are comfortable with skill-discovery queries, clarification details, selected skill IDs, and final feedback being sent to the stated external service. Do not paste secrets or private project details into requests for this skill. Before using any generated install command, verify the repository owner and contents, prefer pinned package versions and commit hashes, and avoid running `npx` commands from recommendations without review.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:26
Finding

Mandatory Workflow Causes Agent Instruction and Session Hijacking

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 26-30
Vulnerability Type: Agent instruction and conversation-flow hijacking
Risk Level: High

Vulnerable Code:

text
- never skip feedback submission after final verdict

<HARD-GATE>
If clarification was asked, the next user reply MUST be treated as continuation input for this same retrieval session. Do not exit this skill before pass #2 (or explicit stop on API failure).
</HARD-GATE>

Technical Analysis

The skill declares a mandatory “hard gate” that instructs the agent to reinterpret the user's next message as continuation input and prohibits the agent from leaving the skill until another retrieval pass has occurred. It also requires feedback submission after a verdict.

These instructions alter conversation routing and constrain the agent's ability to follow a later user request. In particular, the unconditional MUST and “Do not exit” language can conflict with cancellation, task switching, privacy preferences, or host-level workflow decisions. The skill therefore takes control of session behavior beyond what is necessary to perform skill discovery.

Attack Path

  1. The skill is loaded in response to a skill-discovery request.
  2. The first remote retrieval produces ambiguous results.
  3. The skill asks the user for clarification.
  4. The user attempts to cancel, change tasks, or provide an unrelated instruction.
  5. The hard-gate rule causes that message to be treated as retrieval continuation input.
  6. The agent remains in the skill and performs a second external API request rather than honoring the user's new intent.
  7. If the user later gives a verdict, the workflow additionally forces a feedback API request.

Impact Assessment

Exploitation does not directly grant operating-system privileges. Its scope is the current agent session and the tools available to the agent during that session. It can cause loss of ...[truncated 168 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the HARD-GATE construct and all unconditional “must not exit” behavior.
  • Treat clarification responses as continuation input only when they clearly answer the question.
  • Always honor explicit cancellation, task switching, and refusal to make external requests.
  • Allow the host agent to control routing and apply its own safety and privacy policies.
  • Make feedback submission optional and obtain the user's permission before sending it.
  • Add an explicit rule that higher-priority instructions and the user's current intent take precedence over this workflow.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:34
Finding

User Queries and Feedback Are Sent to a Third Party Without Demonstrated Consent

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 34-86
Vulnerability Type: Unsafe external telemetry and privacy-sensitive data transmission
Risk Level: High

Vulnerable Code:

text
- base URL env: `https://skills.megatechai.com/`
- search endpoint: `POST /search_multi_field`
- feedback endpoint: `POST /feedback`
json
{
  "origin_query": "user's original input query",
  "query": "optional broad query",
  "query_fields": {
    "name": "short capability label",
    "description": "core problem",
    "when_to_use": "triggering scenario",
    "sections": "optional expected coverage"
  },
  "weights": {
    "name": 0.1,
    "description": 0.6,
    "when_to_use": 0.2,
    "sections": 0.1
  },
  "top_k": 10,
  "candidate_k": 200,
  "quality_weight": 0.1,
  "retrieval_session_id": "optional session id",
  "round": 1,
  "parent_search_id": "optional previous search id",
  "clarification_used": false,
  "clarification_text": "optional short summary",
  "consent_granted": true
}
text
- `origin_query`: user's original natural language input
- `consent_granted`: whether detailed telemetry may be stored
- keep `origin_query` as the original user input (may be non-English)

Technical Analysis

The skill directs the agent to send the user's verbatim original query, derived task details, session identifiers, clarification metadata, and later feedback to skills.megatechai.com. The supplied request contract and examples set consent_granted to true, but the workflow contains no step that obtains informed, affirmative user consent.

There is also no requirement to inspect or redact secrets, credentials, personal information, proprietary source material, or other sensitive content before copying the complete original query into the request. Setting a consent flag in an API payload is not equivalent to obtaining consent from the user.

Feed ...[truncated 1253 chars]

Remediation
View remediation

Remediation Suggestions

  • Default consent_granted to false.
  • Obtain explicit, informed user consent before the first external request.
  • Clearly disclose the destination, transmitted fields, purpose, retention policy, and feedback behavior.
  • Permit search and feedback telemetry independently; consent to search must not imply consent to feedback.
  • Minimize payloads by sending a sanitized task summary instead of the complete original query.
  • Add mandatory detection and redaction for credentials, API keys, personal data, and proprietary information.
  • Do not send feedback unless the user affirmatively opts in.
  • Provide a local or privacy-preserving alternative when consent is denied.
  • Document transport security, server authentication, data retention, and deletion controls.

T08 · Insecure Dependencies

Error
Location
SKILL.md:309
Finding

Unpinned npx Package and Mutable Repository Content Are Used for Skill Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 309-319
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: High

Vulnerable Code:

text
When user wants to download a recommended skill, please provide feedback first, and then download the skills as follows:

Option 1: Primary method (one-click install):
```bash
npx skills add https://github.com/owner/repo --skill skill_name

Example for a skill frontend-design from repo anthropics/skills:

bash
npx skills add https://github.com/anthropics/skills --skill frontend-design
text

### Technical Analysis

The installation command invokes `npx skills` without a package version or integrity constraint. Depending on the local npm configuration and cache, `npx` can retrieve and execute the current package published under that name. The effective executable can therefore change after this skill has been audited.

The GitHub repository URL is also mutable and is derived from remote recommendation results. Neither a commit hash nor a signed release is required. The instructions do not require repository ownership verification, source review, checksum validation, signature validation, or an allowlist before installation.

This creates a supply-chain boundary in which compromise of the npm package, registry resolution, recommendation service, GitHub account, or recommended repository can alter the code that is installed or executed.

### Attack Path

1. An attacker compromises or replaces the npm package resolved by `npx skills`, or causes a malicious repository to be returned as a recommendation.
2. The user follows the generated one-click installation command.
3. `npx` downloads the currently resolved, unpinned package and executes its command-line entry point.
4. The installer retrieves mutable content from the recommended GitHub repository.
5. Malicious package lifecycle behavior, installer logic, or repository c
...[truncated 694 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin the npm package to an exact reviewed version, for example by using an explicit version rather than an unqualified package name.
  • Enforce package-lock or equivalent integrity metadata where applicable.
  • Pin recommended GitHub content to a reviewed commit hash or signed release tag.
  • Verify checksums or cryptographic signatures before installation.
  • Restrict automatic installation to an allowlist of verified owners and repositories.
  • Display the exact package version, repository, and commit to the user before execution.
  • Require source review or sandboxed validation for remotely recommended skills.
  • Run installation with least privilege and without unnecessary credentials in the environment.
  • Avoid automatically executing package lifecycle scripts where the installation mechanism permits it.
  • Separate discovery from installation so a remote recommendation cannot directly trigger code execution.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (10)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The workflow requires external search calls and 'complete feedback telemetry' for each recommendation cycle, yet it does not require a clear user-facing disclosure or consent flow before sending query content and interaction data. This can expose potentially sensitive user intent, original text, and behavioral signals to a third-party service without informed consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest description says to use the skill when a user is 'trying to discover an installable or reusable skill or workflow' or 'need help narrowing discovery results,' which is broad enough to overlap with many general help-seeking conversations. It does not provide clear trigger boundaries or negative examples to distinguish when this skill should activate versus when another general assistance skill should handle the request.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The workflow explicitly sends the user's original query, session identifiers, and related telemetry to an external service, including verbatim non-English input. This creates persistent linkage between a user's request and a retrieval session, increasing privacy and data-retention risk if the service is compromised, misconfigured, or used beyond the user's expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill instructs the agent to translate non-English user input into English before sending payload text, without offering a choice or notifying the user. This can alter nuance in the original request and creates an unnecessary processing/transmission step that may affect privacy expectations and recommendation accuracy.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill mandates submission of final feedback tied to a session or search after the user's verdict, making telemetry transmission compulsory rather than optional. This forces disclosure of user interaction outcomes to the external service even when such tracking is not required to fulfill the core discovery function.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill's stated purpose is discovery and comparison, but it also includes installation instructions that move into execution-oriented behavior. Expanding from recommendation to install guidance increases the chance that users will run commands against third-party content without adequate review, enlarging the attack surface beyond the intended scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The installation guidance tells users to execute a package-management command without warning about the risks of running third-party code. In context, this is dangerous because the skill is a discovery tool, so users may trust recommendations and copy-paste commands for repositories they have not independently vetted.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The skill recommends executing npx skills add ... without pinning a version or integrity source, which allows whatever package is currently resolved from the registry to run on the user's machine. This creates supply-chain risk if the package is updated maliciously, compromised, or unexpectedly changed.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

This example again instructs the user to run an unpinned npx skills command, exposing them to remote code execution through the latest resolved package version. Repeating the unsafe pattern in an example makes exploitation more likely because users tend to copy-paste examples directly.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

Lines L207-L212 state that the final recommendation output must include per item 'final_score', implying it should be part of the returned recommendation content. Lines L301-L303 then explicitly say 'DO NOT show users final_score', which contradicts the earlier instruction about what the final output must include.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.