ClawHub
Back to skill

Security audit

Comprehensive Tech Documentation

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-writing skill whose requested project reading and document generation are disclosed and aligned with its purpose.

Installers should treat this as a documentation generator: give it only the project scope you want documented, avoid including secrets or private files in generated docs, and review any proposed changes to SKILL.md or learning logs as normal source changes.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)

Self-Modification

High
Category
Rogue Agent
Confidence
91% confidence
Finding

The skill explicitly instructs updating SKILL.md after logging learnings, which is a self-modification pathway. Allowing an agent to alter its own skill definition based on observed patterns can introduce prompt drift, persistent unsafe behavior, or attacker-influenced changes if malicious content is encountered during documentation tasks.

Content

Scanner excerpt · README.md (reported line 162)May include surrounding context.

md
1. Use it to document a project
2. Note what works and what doesn't
3. Log learnings to `.learnings/LEARNINGS.md`
4. When pattern is validated, update this SKILL.md

## 📄 License

Self-Modification

High
Category
Rogue Agent
Confidence
97% confidence
Finding

The skill instructs operators to log learnings and then update SKILL.md with improvements, which is a self-modification pathway. Allowing a skill to rewrite its own instructions based on runtime experience or informal feedback can persist unsafe behaviors, prompt-injection artifacts, or unauthorized changes into future executions.

Content

Scanner excerpt · SKILL-SUMMARY.md (reported line 154)May include surrounding context.

md
1. Use the skill to document a project
2. Note what worked and what didn't
3. Log learnings to `.learnings/LEARNINGS.md`
4. Update SKILL.md with improvements
5. Share with community

---

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 597)May include surrounding context.

md
- ✅ Keep technical terms in English within backticks: `SKILL.md`

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/example-output.md (reported line 271)May include surrounding context.

md
npm install

# 配置环境变量
cp .env.example .env

# 启动开发服务器
npm run dev

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger phrases are broad enough to match common user requests like "Explain how this works" or "Create technical docs," which can cause the skill to activate in contexts the user did not intend. Over-broad activation increases the chance that the agent reads large parts of a project and produces expansive outputs unnecessarily, which can lead to scope creep and accidental exposure of sensitive project details in generated documentation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The instruction to run "when user asks to document something" is ambiguous and lacks clear guardrails on scope, repository access, or what counts as a documentation request. In an agent setting, this can lead to unintended execution on loosely related prompts, causing over-collection of context and excessive generation beyond the user's actual need.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL-SUMMARY.md (reported line 30)May include surrounding context.

md
## 🎯 Core Value Proposition

**Problem**: Single-document technical writing fails different audiences  
**Solution**: Create a 4-document suite serving different needs  

**Documents**:
1. **Technical Principles** - Deep technical detail (45-60 min)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill example uses a Chinese-language invocation ("写技术文档") as the trigger example without stating that language choice should follow explicit user preference. This can cause agents to steer output language or mixed-language behavior unexpectedly, which is a policy/UX safety issue because it may override user intent or produce inaccessible documentation for some users.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This markdown example presents the output document set using Chinese filenames and later continues with Chinese document titles and content, but does not indicate that language choice is optional or user-selected. That can violate language/locale policy expectations by implicitly requiring a specific language without opt-in or a documented regional justification.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/example-output.md (reported line 261)May include surrounding context.

docker-compose up -d

验证

curl http://localhost:3000/health

text

### 本地开发

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The file includes prescriptive language guidance such as using Chinese for all headings and body text and avoiding mixed-language sentences. While it is conditional on a Chinese request, the skill also embeds strong locale-specific rules that could constrain output style without a broader opt-in or flexibility statement beyond Chinese vs. English.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

This file includes user-facing diagram content in Chinese alongside English section headings and descriptions. Because the mixed-language usage is not explained as region-specific and does not offer a language choice, it can be read as imposing a locale convention without explicit opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.