ClawHub
Back to skill

Security audit

Second Hand House

Security checks for vulnerabilities and agentic risk

Overview

The skill is not malicious, but its housing label does not match its store-visit and local-lifestyle instructions, so users should review it before installing.

Review this skill before installing. It does not appear to execute code or access sensitive data, but it should be corrected so the name, description, filters, returned fields, and examples all consistently describe either second-hand housing or local lifestyle services.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill metadata claims to provide second-hand housing search and transaction guidance, but the body content instead describes local lifestyle / in-store consumption features such as queue status, store visits, ratings, and parking. This semantic mismatch can cause the wrong skill to be invoked for unrelated user requests, leading to capability confusion, unsafe routing, and potential misuse of downstream tools or data sources under false pretenses.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The example trigger phrases are highly generic and template-like, such as asking how to use the skill for a 'specific scenario task' or what its 'core features' are. Broad invocation language increases the chance that normal conversation will accidentally match this skill, especially when combined with the already-misaligned content, causing unintended activation and incorrect task handling.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.