ClawHub
Back to skill

Security audit

Batch Plan Execute

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed planning and execution workflow that writes scoped plan files and only implements code after an explicit user command.

Install only if you want an agent to create and maintain plan files in your repository and, after a clear execution command, coordinate code changes through subagents. Review generated plans before issuing an execution command, and be aware that a hidden planning state file may be created under plans/.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Forcing output language to match the requirement source without explicit user opt-in can reduce user visibility into what the agent is planning or executing, especially when file changes, state updates, and execution progress are involved. In this skill, that matters more because misunderstood plan contents or execution status could lead to incorrect approval, missed review comments, or accidental implementation of unintended work.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill explicitly instructs the agent to create and update files under plans/, including a hidden state file, but it does not warn the user that invoking the skill can write to disk. In an agent setting, undisclosed filesystem side effects can surprise users, alter repository state, and create persistence artifacts that may later influence execution or reviews.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.