ClawHub
Back to skill

Security audit

Qa

Security checks for vulnerabilities and agentic risk

Overview

This QA skill is state-changing, but its testing, fixing, reporting, browser use, and git commits are disclosed and fit its stated purpose.

Install only if you want an agent to test a web app, edit code, create QA reports, and make git commits. Use a clean branch, avoid production credentials unless necessary, and confirm the target app and scope before running.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
91% confidence
Finding

The anti-refusal instruction pressures the agent to always use the browser, even when browser interaction may be unsafe, unauthorized, unnecessary, or blocked by policy constraints. Such language can weaken safety decision-making and push execution into contexts involving sensitive environments, authenticated sessions, or destructive side effects where the agent should pause and seek confirmation.

Content

Scanner excerpt · SKILL.md (reported line 247)May include surrounding context.

md
7. **Test like a user.** Use realistic data. Walk complete workflows end-to-end.
8. **Depth over breadth.** 5-10 well-documented issues > 20 vague descriptions.
9. **Never delete output files.**
10. **Never refuse to use the browser.** Backend changes affect app behavior — always open the browser and test.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The top-level description emphasizes QA testing but does not upfront warn that the skill will modify source code and create atomic git commits. That can mislead users into invoking what appears to be a read-only testing workflow, when in fact it performs state-changing actions on both the working tree and git history.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrases and proactive suggestion guidance are broad enough that the skill may activate in situations where the user only wants evaluation, not code modification. Because this skill can test, edit source, and create commits, accidental invocation can lead to unintended repository changes or actions against a running app without sufficiently explicit user consent.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

L242 states an absolute rule to never read source code during QA, presenting the process as user-level testing only. However, the documented workflow later includes locating source files with grep/glob and explicitly reading source and applying fixes in L189-L197, so the documentation contradicts the actual intended behavior of the skill.

Content

No source excerpt is available for this finding.