ClawHub
Back to skill

Security audit

Polito Notes

Security checks for vulnerabilities and agentic risk

Overview

The skill appears intended for lecture-note generation, but it persistently duplicates full PDF contents and allows downstream local indexing without a clear opt-in or redaction step.

Review this carefully before installing if your PDFs may contain personal, confidential, unpublished, or regulated information. Use it only for lecture material you are comfortable storing as plaintext notes, backups, and searchable local RAG entries, and consider disabling indexing or adding a redaction/confirmation step for sensitive documents.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:82
Finding

Uncontrolled Duplication and Indexing of Potentially Sensitive PDF Content

Content
View full analysis
.bak` (e.g., `notes.md.bak`, `notes-en.md.bak`). 9. **Sensitive data warning** — PDFs may contain sensitive or personal data. All content from the PDF will be preserved verbatim in the generated markdown notes. Ensure notes are stored securely and not shared publicly. ``` Related automatic indexing behavior: ```markdown ## RAG Integration After generating not ...[truncated 3067 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The natural-language description requires generation of bilingual notes in Italian and English by default, and later sections reinforce that both files must always be produced. This imposes a language policy on users without stating an opt-in, choice, or justified locale-specific constraint.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger list includes generic everyday terms such as "notes," "materia," and "lezione," which can cause the skill to activate in contexts unrelated to PDF note generation. Unintended activation increases the chance that user files are processed and written into persistent course folders without clear user intent, especially since the skill also preserves content and stores outputs on disk.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill explicitly requires zero information loss and states that all PDF content, including potentially sensitive or personal data, will be preserved in generated markdown and then picked up by downstream local indexing. This creates a clear risk of persistent storage, duplication, and later retrieval of sensitive material beyond the user's immediate task, which materially expands exposure.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

md
## Rules

1. **Zero information loss** — every definition, formula, example, use case, caveat, and technical detail from the PDF must appear in the output. Nothing gets skipped.
2. **Narrative flow** — write in continuous prose, not mechanical lists. Bullet points only when genuinely natural (e.g., listing properties). Prefer "The key idea behind X is..." over "• X is...".
3. **Visual reconstruction** — every diagram, schema, or figure in the PDF becomes a **Mermaid diagram** when possible (flowcharts, sequences, hierarchies). For complex visual layouts (matrices, heatmaps, scatter plots, mathematical plots), use a **descriptive paragraph** explaining what the figure shows instead of forcing an inaccurate Mermaid diagram.
4. **Formulas** — LaTeX `$$block$$` or `$inline$`. After each formula, explain every symbol in words.
5. **Terminology** — first occurrence of a technical term: **bold**. Standard English terms stay in English even in the Italian version (with Italian explanation on first use).

Static analysis

No suspicious patterns detected.