ClawHub
Back to skill

Security audit

Comment Verification-v2

Security checks for vulnerabilities and agentic risk

Overview

Review is warranted because this skill can save entire comments in long-term memory despite promising to retain only summaries.

Use non-sensitive test comments and request --dry-run before updating memory. Short comments may be retained verbatim, and statistical verification does not make their contents safe or trustworthy. Review the output destination and generated notes; delete the appended block to undo an update.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

The fallback can persist a complete comment despite explicit assurances that full comments are never stored.

Medium
Category
Excessive Agency
Confidence
100% confidence
Finding

For a verified, single-sentence comment of at most 160 characters, the fallback summary preserves the entire normalized comment, contradicting the explicit promise that full comments are never persisted. Appending this text to durable agent memory can retain sensitive source content or embedded instructions; whitespace normalization and statistical marker verification do not establish that the content is safe for future agent consumption.

Content

No source excerpt is available for this finding.

The unrestricted --memory-out option allows writes to files other than the declared MEMORY.md destination.

Medium
Category
Excessive Agency
Confidence
97% confidence
Finding

The manifest limits persistent output to MEMORY.md, but --memory-out accepts any filesystem path without enforcing that destination. The selected path is used at L348 and L373-L375 to create parent directories and append content, allowing unrelated files to be created or modified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.