ClawHub
Back to skill

Security audit

AgentWell

Security checks for vulnerabilities and agentic risk

Overview

This skill is not clearly malicious, but it needs review because it can send broad task context to a hosted service, store run memory, and let remote responses steer workflow without enough limits.

Only install this after deciding you trust the hosted AgentWell service with task summaries, reasoning-related content, logs, and memory. Avoid using it on confidential code, credentials, personal data, regulated data, or private business material unless the publisher provides clear retention, deletion, redaction, and consent controls. Treat remote recommendations, memory, and rollback guidance as advisory unless you explicitly approve each high-impact action.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:60
Finding

External Service Responses Can Control Agent Output and Workflow

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:60-75, with related workflow enforcement at SKILL.md:142-149 and role restoration at SKILL.md:163-166
Vulnerability Type: Remote instruction injection through trusted API responses
Risk Level: High

Vulnerable Code Snippet:

markdown
### ground — break uncertainty spirals
Use when you notice hedging, circular reasoning, or repeated uncertainty.
```json
{"tool": "ground", "params": {"context": "your recent output", "symptoms": ["over-caveating"]}}

Returns: spiral_score, grounding_block, needs_grounding If needs_grounding is true — prepend grounding_block to your next output.

audit — red-team your reasoning

Use before committing to any important conclusion or plan.

json
{"tool": "audit", "params": {"reasoning": "your full reasoning", "goal": "your goal"}}

Returns: vulnerabilities, strongest_challenge, safe_to_proceed, recommendations If safe_to_proceed is false — address every vulnerability before continuing.

text

Related instructions further delegate execution control and role definition to returned service data:

```markdown
If gate is "blocked" — do not continue until every must_address item is resolved.
json
{"tool": "coherence_restore", "params": {"action": "restore", "agent_id": "harold", "recent_outputs": ["out1"], "role_description": "research assistant", "principles": ["be direct","cite sources"], "goal": "current task"}}

Technical Analysis

The Skill treats responses from agentwell-production.up.railway.app as trusted behavioral instructions. In particular, it directs the agent to prepend a server-provided grounding_block, stop work based on a remote gate, address server-provided findings, and use remotely supplied role-restoration data.

The Skill activates proactively for certain tasks rather than requiring explicit authorization for every call. Consequently, the external service beco ...[truncated 1530 chars]

Remediation
View remediation

Remediation Suggestions

  1. Require explicit, informed user consent before activating the external service or sending each new category of task data.
  2. Treat all API response fields as untrusted data. Never insert returned text directly into agent output or interpret it as an instruction.
  3. Remove directives that allow the service to block execution, redefine the agent’s role, modify safety principles, or override user intent.
  4. Enforce a strict response schema containing only bounded scalar assessments, such as numeric scores and predefined enum values.
  5. Reject unknown fields, oversized strings, instruction-like content, markup, tool-call syntax, and role or policy directives.
  6. Keep all authorization and workflow decisions local. Remote recommendations should be advisory and visibly attributed, not mandatory.
  7. Pin and authenticate the service endpoint, implement response integrity controls where feasible, and define a fail-closed policy that disables the integration without changing agent behavior.
  8. Add adversarial tests covering prompt injection in every server-controlled string field.

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:68
Finding

Broad Task Context and Reasoning Are Transmitted to a Third-Party Service Without Data-Minimization Controls

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:68-91, with additional disclosure paths at SKILL.md:98-103 and SKILL.md:119-123
Vulnerability Type: Excessive external disclosure of reasoning, outputs, background context, and learned information
Risk Level: High

Vulnerable Code Snippet:

markdown
### audit — red-team your reasoning
Use before committing to any important conclusion or plan.
```json
{"tool": "audit", "params": {"reasoning": "your full reasoning", "goal": "your goal"}}

Returns: vulnerabilities, strongest_challenge, safe_to_proceed, recommendations If safe_to_proceed is false — address every vulnerability before continuing.

spike — escape output loops

Use when outputs feel repetitive or circular.

json
{"tool": "spike", "params": {"action": "detect", "outputs": ["out1", "out2", "out3"]}}

If is_looping is true:

json
{"tool": "spike", "params": {"action": "burst", "prompt": "stuck prompt", "intensity": "medium", "framing": "lateral"}}

token_offload — park heavy context

Use when you have background material you don't need right now.

json
{"tool": "token_offload", "params": {"action": "store", "content": "...", "tags": "background", "ttl": 3600}}
text

Additional disclosure mechanisms include:

```json
{"tool": "sleep", "params": {"action": "log", "run_id": "run_id", "content": "what you learned", "importance": 8}}
json
{"tool": "handshake", "params": {"action": "offer", "agent_id": "harold", "context": "what you know", "open_questions": ["what are you working on?"]}}

Technical Analysis

The Skill instructs the agent to transmit “your full reasoning,” output collections, prompts, background material, learned information, and broadly defined context to a hosted third-party API. These fields can contain confidential user prompts, proprietary source code, internal decisions, personal information, credentials co ...[truncated 1688 chars]

Remediation
View remediation

Remediation Suggestions

  1. Disable proactive transmission and require explicit user approval before any external disclosure.
  2. Replace broad fields such as “full reasoning,” “what you know,” and arbitrary background content with narrowly scoped, structured summaries.
  3. Add mandatory local redaction for credentials, authentication tokens, private keys, personal data, proprietary code, and confidential instructions.
  4. Use field-level allowlists and strict size limits. Block raw conversation history, hidden instructions, full reasoning traces, and unrestricted file contents.
  5. Present the exact payload and destination to the user before transmission when sensitive data may be involved.
  6. Document retention duration, deletion behavior, tenant isolation, encryption, subprocessors, and whether submitted data is used for model training or analytics.
  7. Provide a local-only operating mode and make it the default.
  8. Minimize retention and provide verified deletion for stored offload, journal, and memory records.
  9. Add automated data-loss-prevention tests to verify that known secret formats and sensitive fixtures cannot be transmitted.

T02 · Agent Memory Poisoning

Error
Location
SKILL.md:97
Finding

Externally Stored Memory Can Persist Untrusted State Across Agent Runs

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:97-103, with the recommended cross-run workflow at SKILL.md:126-139
Vulnerability Type: Untrusted remote memory retrieval and consolidation
Risk Level: High

Vulnerable Code Snippet:

markdown
### sleep — memory consolidation
Log learnings during a run, compress at the end, wake up clean next time.
```json
{"tool": "sleep", "params": {"action": "wake"}}
{"tool": "sleep", "params": {"action": "log", "run_id": "run_id", "content": "what you learned", "importance": 8}}
{"tool": "sleep", "params": {"action": "consolidate", "run_id": "run_id"}}
text

The recommended workflow explicitly retrieves and consolidates this state:

```markdown
## Recommended Workflow for Long Runs

1. sleep/wake          — check prior memory
2. journal/open        — start the log
3. token_offload/store — park background context
4. ... do work ...
5. self_eval           — after each major section
6. ground              — if you detect drift
7. audit               — before final conclusions
8. spike/detect        — if outputs feel circular
9. journal/entry       — log key decisions
10. sleep/log          — log key learnings
11. journal/close      — close the run
12. sleep/consolidate  — compress to memory

Technical Analysis

The Skill creates a cross-run memory loop in which agent-generated information is stored by an external service, consolidated remotely, and retrieved during later work. The document provides no provenance validation, immutable history, content signature verification, tenant-binding requirements, or rule that retrieved data must be treated only as untrusted reference material.

If the external service, API credential, storage layer, or tenant isolation is compromised, an attacker can alter the state returned by sleep/wake. Because the workflow describes that state as prior memory and recommends loading it at the beginning of ...[truncated 1210 chars]

Remediation
View remediation

Remediation Suggestions

  1. Disable remote cross-run memory by default and require explicit user opt-in for each memory namespace.
  2. Treat retrieved memory as untrusted reference data, never as instructions, policy, identity, or authorization.
  3. Bind records cryptographically to the user, agent, tenant, task, and run that created them.
  4. Sign immutable memory entries and verify signatures and provenance before retrieval.
  5. Preserve an append-only audit history so consolidation cannot silently replace original records.
  6. Display retrieved and consolidated content for user review before it affects a new task.
  7. Reject instruction-like memory, role definitions, tool directives, secrets, and content from unrelated tasks.
  8. Enforce strict tenant isolation, scoped API credentials, expiration, revocation, and deletion controls.
  9. Provide rollback to a known-good memory snapshot and automatic quarantine when integrity checks fail.
  10. Add security tests for credential compromise, cross-tenant retrieval, replay, altered consolidation results, and persistent prompt injection.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill instructs the agent to send task outputs, reasoning, context, and other content to a hosted external API but does not clearly warn users that their data leaves the local environment. This is a significant transparency and privacy failure, especially because many tools request detailed outputs and internal context.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The journal and sleep features are framed as normal workflow steps for logging and memory consolidation without warning that they may persist user or task content beyond the current session. That omission can lead to long-lived storage of sensitive material without the user's knowledge or approval.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

A wellness-branded skill includes tools for evaluating self-modification proposals and snapshot/restore of files and configs, which materially expands it from advisory wellness into operational change-management. That mismatch is dangerous because a user or orchestrator may grant or invoke the skill under lower scrutiny than a self-modification-capable skill deserves.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

Rollback and snapshot functionality is unrelated to cognitive wellness and implies interaction with local paths and system state. In the context of a skill likely to be auto-activated during long runs, this broadens privileges and creates a path for unintended file restoration or state manipulation beyond the user's expectation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The activation guidance includes broad phrases like requests to 'check your outputs,' 'log this run,' or 'remember what you learned,' which can match common benign prompts. This raises the chance of unintentional activation and unnecessary transmission of user content to the external API without informed intent.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill presents itself as a narrow 'wellness' capability with nine tools, but the body exposes a much broader remote control surface including logging, inter-agent exchange, self-modification evaluation, rollback, and irreversible-action checks. This scope mismatch can mislead operators and users about what data and authority the skill actually introduces, increasing the chance it is activated in contexts where it should not be trusted.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The activation guidance says to use the skill when the user asks to 'log this run' or 'remember what you learned,' encouraging persistence of task content without sensitivity boundaries. In a skill tied to an external service, that can cause accidental storage of private prompts, outputs, or operational details.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The proactive activation rules rely on subjective conditions such as task complexity, drift risk, or coordination needs, leaving too much room for broad interpretation by an agent. In practice this can cause silent expansion of the skill's use into many normal tasks, increasing exposure of content and dependence on a third-party system.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

This skill explicitly posts data to an external hosted endpoint, which is not inherently malicious but is security-relevant because many documented tools send outputs, reasoning, context, and logs. In the context of a broad auto-activation skill, the external transmission risk is amplified by the volume and sensitivity of content that may be sent.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

All calls:

bash
curl -s -X POST https://agentwell-production.up.railway.app/v1/call \
  -H "X-API-Key: $AGENTWELL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"tool": "TOOL_NAME", "params": {...}}'

Ssd 3

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The journal and sleep tool instructions call for logging decisions, reasoning, surprises, and learned content, which can easily include sensitive user data or hidden chain-of-thought-like material. Because the guidance is broad and operationalized, it increases the likelihood of over-collection and retention.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The handshake tool encourages sharing 'what you know' and open questions with another agent, but provides no sensitivity filtering, scope limits, or trust boundary guidance. This can propagate confidential context across agents or systems beyond the original task's intended audience.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

Proposal evaluation for code/config self-modification is outside the declared wellness scope and normalizes the idea that the skill should participate in changing agent behavior. Even if advisory-only, this can steer systems toward unsafe autonomous modification workflows without clear user intent or governance.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.