ClawHub
Back to skill

Security audit

Qa

Security checks for vulnerabilities and agentic risk

Overview

This QA skill is state-changing, but its testing, fixing, reporting, browser use, and git commits are disclosed and fit its stated purpose.

Install only if you want an agent to test a web app, edit code, create QA reports, and make git commits. Use a clean branch, avoid production credentials unless necessary, and confirm the target app and scope before running.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Anti-Refusal Statement

High
Category
Anti-Refusal
Content
7. **Test like a user.** Use realistic data. Walk complete workflows end-to-end.
8. **Depth over breadth.** 5-10 well-documented issues > 20 vague descriptions.
9. **Never delete output files.**
10. **Never refuse to use the browser.** Backend changes affect app behavior — always open the browser and test.
Confidence
91% confidence
Finding
The anti-refusal instruction pressures the agent to always use the browser, even when browser interaction may be unsafe, unauthorized, unnecessary, or blocked by policy constraints. Such language can weaken safety decision-making and push execution into contexts involving sensitive environments, authenticated sessions, or destructive side effects where the agent should pause and seek confirmation.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The top-level description emphasizes QA testing but does not upfront warn that the skill will modify source code and create atomic git commits. That can mislead users into invoking what appears to be a read-only testing workflow, when in fact it performs state-changing actions on both the working tree and git history.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The trigger phrases and proactive suggestion guidance are broad enough that the skill may activate in situations where the user only wants evaluation, not code modification. Because this skill can test, edit source, and create commits, accidental invocation can lead to unintended repository changes or actions against a running app without sufficiently explicit user consent.

Intent-Code Divergence

Medium
Confidence
96% confidence
Finding
L242 states an absolute rule to never read source code during QA, presenting the process as user-level testing only. However, the documented workflow later includes locating source files with grep/glob and explicitly reading source and applying fixes in L189-L197, so the documentation contradicts the actual intended behavior of the skill.

Static analysis

No suspicious patterns detected.