ClawHub
Back to skill

Security audit

Prose

Security checks for vulnerabilities and agentic risk

Overview

This skill is a high-authority workflow runner that can execute remote programs, create persistent agent memory, and expose database credentials without enough guardrails.

Install only if you intend to run OpenProse as a powerful workflow execution environment. Treat .prose files like code, avoid running remote programs unless you trust and review them, do not use production databases or real secrets, prefer local filesystem state, and review or disable project/user/custom persistence before use.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (6)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:70
Finding

Arbitrary Remote OpenProse Programs Are Retrieved and Executed Without a Trust Boundary

Content
View full analysis
Remediation
View remediation

T01 · Skill Instruction Hijacking

Error
Location
guidance/system-prompt.md:6
Finding

Bundled System-Prompt Enforcement Overrides Session Goals and Delegates Authority to Program Text

Content
View full analysis
Remediation
View remediation

T02 · Agent Memory Poisoning

Error
Location
prose.md:447
Finding

Untrusted Programs Can Establish Cross-Project Memory or Write Persistent State to Custom Paths

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
state/postgres.md:60
Finding

PostgreSQL Connection Credentials Are Intentionally Exposed to Arbitrary Subagents

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
state/postgres.md:136
Finding

Recommended PostgreSQL Docker Configuration Publishes a Trust-Authenticated Database Port

Content
View full analysis
.prose/.env ``` A one-line equivalent appears in `SKILL.md:203-204`. ### Technical Analysis `POSTGRES_HOST_AUTH_METHOD=trust` permits clients matching the generated host authentication rule to authenticate without supplying a password. Publishing the container with `-p 5432:5432` binds the database port to the host's network interfaces by default. This combination is unsafe on shared machines, development systems reachable from a local network, cloud hosts with permissive firewall rules, and CI runners. The connection uses the PostgreSQL superuser account and does not require authentication. The setup exceeds the minimum privileges necessary for local workflow state. A local-only state service does not need unauthenticated access on every host interface. ### Attack Path 1. A user follows the documented “recommended” Docker setup. 2. Docker publishes port 5432 on the host. 3. PostgreSQL accepts host connections using trust authentication. 4. An attacker who can reach the exposed port connects without a password. 5. The attacker authenticates as an authorized PostgreSQL role, potentially `postgres`. 6. The attacker reads, modifies, or deletes OpenProse data and may exercise database-superuser capabilities inside the container. ### Impact Assessment Potential impact includes: - Complete disclosure of workflow programs, prompts, outputs, and memories - Modification or deletion of all OpenProse state - Persistent memory poisoning - Database object creation or destruction - Abuse of PostgreSQL superuser capabilities with ...[truncated 225 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
state/postgres.md:461
Finding

Generated Prompts and Outputs Are Embedded into Command-Line SQL Without a Safe Parameterization Protocol

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (72)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 9)May include surrounding context.

md
ailed system description, they don't just describe it, they _simulate_ it. The `prose.md` specification describes a virtual machine with enough fidelity that a

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md
ailed system description, they don't just describe it, they _simulate_ it. The `prose.md` specification describes a virtual machine with enough fidelity that a

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

md
ailed system description, they don't just describe it, they _simulate_ it. The `prose.md` specification describes a virtual machine with enough fidelity that a

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.

md
ailed system description, they don't just describe it, they _simulate_ it. The `prose.md` specification describes a virtual machine with enough fidelity that a

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.

md
ailed system description, they don't just describe it, they _simulate_ it. The `prose.md` specification describes a virtual machine with enough fidelity that a

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 169)May include surrounding context.

md
ailed system description, they don't just describe it, they _simulate_ it. The `prose.md` specification describes a virtual machine with enough fidelity that a

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 246)May include surrounding context.

md
ailed system description, they don't just describe it, they _simulate_ it. The `prose.md` specification describes a virtual machine with enough fidelity that a

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md
| `prose compile <file>` | Load `compiler.md`, validate the program |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

md
| `prose compile <file>` | Load `compiler.md`, validate the program |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.

md
| `prose compile <file>` | Load `compiler.md`, validate the program |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 146)May include surrounding context.

md
| `prose compile <file>` | Load `compiler.md`, validate the program |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 213)May include surrounding context.

md
| `prose compile <file>` | Load `compiler.md`, validate the program |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 314)May include surrounding context.

md
| `prose compile <file>` | Load `compiler.md`, validate the program |

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill explicitly supports fetching and executing remote .prose programs from arbitrary URLs or shorthand registries, but it does not require a trust warning, provenance check, sandboxing guidance, or explicit user confirmation. Because this skill's purpose is to orchestrate multi-agent workflows and file/network actions, executing untrusted remote content materially increases the risk of prompt injection, data exfiltration, or unsafe workspace operations.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
88% confidence
Finding

The instructions direct the agent to inspect .prose/.env and environment variables for OPENPROSE_POSTGRES_URL, which commonly contains embedded database credentials. In a skill that may pass context to subagents and expose logs, reading or echoing secrets increases the chance of credential disclosure through outputs, traces, or downstream tool invocations.

Content

Scanner excerpt · SKILL.md (reported line 181)May include surrounding context.

  1. Check for connection configuration first:
    bash
    # Check .prose/.env for OPENPROSE_POSTGRES_URL
cat .prose/.env 2>/dev/null | grep OPENPROSE_POSTGRES_URL
# Or check environment variable
echo $OPENPROSE_POSTGRES_URL

Credential Access

High
Category
Privilege Escalation
Confidence
94% confidence
Finding

The example echo $OPENPROSE_POSTGRES_URL explicitly outputs the full connection string, which may include username, password, host, and database details. Exposing secrets directly in terminal output or logs is a classic credential leakage path and is especially risky in agent frameworks that retain transcripts or share context with spawned sessions.

Content

Scanner excerpt · SKILL.md (reported line 182)May include surrounding context.

  1. Check for connection configuration first:
    bash
    # Check .prose/.env for OPENPROSE_POSTGRES_URL
cat .prose/.env 2>/dev/null | grep OPENPROSE_POSTGRES_URL
# Or check environment variable
echo $OPENPROSE_POSTGRES_URL

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 200)May include surrounding context.

md
1. Set up a PostgreSQL database (Docker, local, or cloud)
   2. Add connection string to .prose/.env:

      echo "OPENPROSE_POSTGRES_URL=postgresql://user:pass@localhost:5432/prose" >> .prose/.env

   Quick Docker setup:
      docker run -d --name prose-pg -e POSTGRES_DB=prose -e POSTGRES_HOST_AUTH_METHOD=trust -p 5432:5432 postgres:16

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 204)May include surrounding context.

md
1. Set up a PostgreSQL database (Docker, local, or cloud)
   2. Add connection string to .prose/.env:

      echo "OPENPROSE_POSTGRES_URL=postgresql://user:pass@localhost:5432/prose" >> .prose/.env

   Quick Docker setup:
      docker run -d --name prose-pg -e POSTGRES_DB=prose -e POSTGRES_HOST_AUTH_METHOD=trust -p 5432:5432 postgres:16

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 297)May include surrounding context.

md
1. Set up a PostgreSQL database (Docker, local, or cloud)
   2. Add connection string to .prose/.env:

      echo "OPENPROSE_POSTGRES_URL=postgresql://user:pass@localhost:5432/prose" >> .prose/.env

   Quick Docker setup:
      docker run -d --name prose-pg -e POSTGRES_DB=prose -e POSTGRES_HOST_AUTH_METHOD=trust -p 5432:5432 postgres:16

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · state/postgres.md (reported line 215)May include surrounding context.

md
1. Set up a PostgreSQL database (Docker, local, or cloud)
   2. Add connection string to .prose/.env:

      echo "OPENPROSE_POSTGRES_URL=postgresql://user:pass@localhost:5432/prose" >> .prose/.env

   Quick Docker setup:
      docker run -d --name prose-pg -e POSTGRES_DB=prose -e POSTGRES_HOST_AUTH_METHOD=trust -p 5432:5432 postgres:16

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · state/postgres.md (reported line 235)May include surrounding context.

md
1. Set up a PostgreSQL database (Docker, local, or cloud)
   2. Add connection string to .prose/.env:

      echo "OPENPROSE_POSTGRES_URL=postgresql://user:pass@localhost:5432/prose" >> .prose/.env

   Quick Docker setup:
      docker run -d --name prose-pg -e POSTGRES_DB=prose -e POSTGRES_HOST_AUTH_METHOD=trust -p 5432:5432 postgres:16

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
70% confidence
Finding

Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

Content

Scanner excerpt · guidance/patterns.md (reported line 676)May include surrounding context.

md
agent structured-reviewer:
  model: sonnet
  prompt: """
    Always respond with this exact JSON structure:
    {
      "verdict": "pass" | "fail" | "needs_review",
      "issues": [{"severity": "high"|"medium"|"low", "description": "..."}],

Credential Access

High
Category
Privilege Escalation
Confidence
89% confidence
Finding

The documented state layout places a .env configuration file alongside execution state and also instructs subagents to read from storage as needed, creating a plausible path for credential discovery or accidental inclusion in context. In an agent VM that spawns subordinate sessions, merely normalizing nearby secret-bearing files increases the chance of secret access and propagation.

Content

Scanner excerpt · prose.md (reported line 157)May include surrounding context.

text
# Project-level state (in working directory)
.prose/
├── .env                              # Config (simple key=value format)
├── runs/
│   └── {YYYYMMDD}-{HHMMSS}-{random}/
│       ├── program.prose             # Copy of running program

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · prose.md (reported line 753)May include surrounding context.

md
- Check if value was pre-supplied or available from runtime context
- If available: bind and continue
- If not available: pause execution, display prompt, wait for user response

### Input Prompt Formats

Credential Access

High
Category
Privilege Escalation
Confidence
81% confidence
Finding

Storing configuration in .prose/.env creates a credible path for accidental credential or secret exposure because developers commonly place tokens, endpoints, and operational settings in .env-style files. In this skill context, the same persistent filesystem used for agent state and run artifacts could expose secrets through local leakage, repository commits, backups, or downstream agent access if not tightly controlled.

Content

Scanner excerpt · state/filesystem.md (reported line 37)May include surrounding context.

text
# Project-level state (in working directory)
.prose/
├── .env                              # Config (simple key=value format)
├── runs/
│   └── {YYYYMMDD}-{HHMMSS}-{random}/
│       ├── program.prose             # Copy of running program

Static analysis

No suspicious patterns detected.