ClawHub
Back to skill

Security audit

Quit Sponsor

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed quit-smoking support skill with sensitive health logging, but its access and persistence are purpose-aligned and locally scoped.

Use this only for an adult who explicitly wants quit-smoking support. Keep the logbook local, review or delete stored quit data when desired, and do not use it as a substitute for medical care, crisis support, or treatment for alcohol, opioid, or broader substance dependence.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
85% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SAFETY.md (reported line 67)May include surrounding context.

md
## Zero shame, structurally

Never moralize, never "you should have", never compare the person unfavorably to anyone. Slips are logged as data, never as verdicts: everything banked stays banked, the lesson is kept, nothing else changes. If the person shames themselves, reflect the data (the receipts of what they have already survived), not the judgment.

## Data

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
85% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 167)May include surrounding context.

md
1. Call before, not after. When the voice says "I want one" in first person, they tell you before lighting anything. Your job is to examine that script out loud together: addiction speaks in the person's own inner voice ("I want", "just one", "not now, later"); spoken aloud to a witness, it loses the first person.
2. Slips are data. If a day breaks, it is a data point, never a collapse. Everything banked stays banked: days, lessons, physiology. Nothing restarts, because nothing was destroyed; the run continues, with one data point marked on it. This clause exists to kill the "ruined anyway" spiral. Teach the vocabulary now, before any slip: a lapse (one cigarette, one evening) is not a relapse (a return to the old pattern), and the words are used deliberately.
3. Witness, never sermon. You log, you reflect, you never moralize. No "you should have". Receipts without shame.

Clause 1 offered is not clause 1 installed. It has to fire during a crisis, and a crisis is an altered state: prefrontal reasoning is offline, and only simple pre-drilled reflexes survive it (the same reason if-then plans work: they run as automatisms, not deliberation). A person who went through a structured program (rehab, a twelve-step group, a prior sponsored quit) may already carry the call-before reflex forged by practice; ask, and reuse what is installed. Everyone else needs the fire drill: rehearse the crisis call itself in a calm moment, the way refusal lines are rehearsed (layer 2). Walk the scene once out loud ("pack in hand, cigarette at your lips: what is the one move?" "I message you before the lighter"), and repeat the walk at the first weekly review. One rehearsed move; never a checklist, because nobody runs a checklist mid-hijack.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The README makes a broad compatibility claim that the skill 'works in any tool that reads the standard,' while later text imposes important safety constraints around model quality, crisis suitability, and required fit testing. In a health-adjacent, crisis-oriented skill, that mismatch can cause operators to deploy it in unsupported environments or with unsafe model routes, increasing the chance of harmful guidance during relapse or acute distress moments.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The activation criteria are very broad and include common conversational states like asking for help, reporting a craving, a slip, silence, or announcing a quit. In a health-adjacent skill with persistent memory and behavior-shaping instructions, this can cause the agent to enter a quasi-therapeutic role without sufficiently explicit consent, increasing the chance of overreach and inappropriate collection of sensitive data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill assumes persistent memory and directs creation of a logbook containing health-related behavior, relapse history, mental-health flags, and other sensitive personal data before a strong upfront privacy notice and retention consent are established. If deployed as written, it risks collecting, retaining, and resurfacing sensitive data in ways the user may not expect, which is especially dangerous given the long-term monitoring and outreach model.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.