ClawHub
Back to skill

Security audit

skillforge

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed skill-package generator whose file-writing behavior fits its purpose, though users should confirm where generated files will be written.

Install only if you want an agent to generate complete skill directories. Before use, specify the target directory and ask the agent to avoid overwriting existing files unless you approve it.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Anti-Refusal Statement

High
Category
Anti-Refusal
Content
> 7. No auxiliary files — Do NOT include README.md, CHANGELOG.md, or other documentation. Skills are for AI agents, not humans.
>
> Your goal is to produce COMPLETE, ACCURATE, and PRODUCTION-READY output. Every section should be thorough and actionable.
> Always respond in the same language as the user's input.

---
Confidence
90% confidence
Finding
The instruction 'Always respond in the same language as the user's input' is an unconditional behavioral directive embedded in system-context guidance. Anti-refusal or unconditional-compliance language is dangerous because it pressures downstream agents to prioritize formatting obedience over safety checks, policy constraints, or refusal conditions when handling risky requests.

Vague Triggers

Medium
Confidence
89% confidence
Finding
The description is broad enough to trigger on common requests about creating, improving, or packaging skills, which increases the chance that this skill is auto-selected in situations where the user only wanted advice or partial edits. Because the skill also contains instructions to generate complete packages and write files to disk, over-broad invocation materially raises the risk of unintended high-impact actions.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill explicitly instructs the agent to write generated files to disk as part of its normal workflow, but it provides no requirement to obtain explicit user confirmation, preview the changes, or constrain the write location. In an agent context, this can cause unintended filesystem modification, overwriting existing files, or persistence of unreviewed content, especially if the user only asked for conceptual help rather than direct file creation.

Natural-Language Policy Violations

Medium
Confidence
92% confidence
Finding
The file declares a same-language response policy in the system context, but multiple downstream step prompts are written in Chinese while surrounding instructions and metadata are in English. This inconsistency can cause the agent to produce outputs in an unintended language, weakening reliability, auditability, and downstream validation assumptions for generated security-sensitive skill artifacts.

Vague Triggers

Medium
Confidence
96% confidence
Finding
The trigger examples are broad phrases such as generic requests for help, which overlap with ordinary user speech and can cause over-triggering of the skill. In an agent ecosystem, overly broad activation language can route unrelated requests into this skill, leading to unintended file generation, prompt injection exposure, or misuse of privileged skill behaviors.

Static analysis

No suspicious patterns detected.