ClawHub
Back to skill

Security audit

QSR Shift Reflection

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed restaurant shift handoff tracker with limited store-scoped memory use, though one background-process phrase should be clarified before operational use.

Before installing, confirm your deployment has appropriate access controls and retention/deletion policies for the store memory engine, since shift notes and issue histories may persist. Treat the Function 4 background wording as documentation that should be corrected to on-demand/read-time tracking.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Skill Enumeration

Medium
Category
Agent Snooping
Content
Every record is tagged with a single store identifier and lives inside that store's namespace. Records never cross store boundaries. In multi-location deployments, each store has its own isolated reflection archive and open issue list. Cross-store rollups (see `ADAPTING THIS SKILL → Multi-location operations`) are produced by reading each store's namespace independently and combining the results at report time, not by merging the underlying records.

### Sibling skill access

Other skills in the QSR Operations Suite may read from this skill's records *only* through the same store-scoped namespace and *only* in read-only mode. The integrations listed under `CONNECTING TO OTHER SKILLS` are read paths, not write paths. No sibling skill modifies, deletes, or re-exports reflection or open issue records.
Confidence
85% confidence
Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
Lines L086-L087 describe Function 4 as a continuous background process. That directly conflicts with the normative behavior stated at L067-L070 and reiterated at L252-L253, which say the skill only runs on operator-triggered interactions and does not run autonomously or on a schedule.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The skill says Function 4 'Runs continuously in the background,' which conflicts with later sections stating the skill is not a daemon and that Function 4 only runs on demand or at read time. This ambiguity could cause unintended invocation assumptions by making it unclear whether the function activates automatically or only during operator-triggered interactions.

Static analysis

No suspicious patterns detected.