ClawHub
Back to skill

Security audit

Subagent Sheepdog

Security checks for vulnerabilities and agentic risk

Overview

This skill is a plain guidance document for truthful launch/status reporting and does not add hidden execution, persistence, credential access, or data movement.

This skill is reasonable to install if you want stricter reporting for delegated or long-running work. It may make agents more cautious about saying work is running, but it does not itself run commands, access credentials, persist state, or contact external services.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

md
> an agent launches something, gets back a session/process/tab handle, and falsely reports that work is running even though startup already failed or never truly began.

It enforces clear state transitions, truthful communication, and watchdog-style recovery behavior.

---

Unbounded Resource Access

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · SKILL.md (reported line 229)May include surrounding context.

md
3. return to `launching_unverified`
4. verify again before claiming success

Do not loop forever.

---

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 250)May include surrounding context.

md
### Bad
“Background worker launched and running now.”

(But only a session id exists; no verification was done.)

### Good
“Launch attempted; verifying startup.”

Static analysis

No suspicious patterns detected.