Security audit

Find Skills Local

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed skill-finder and installer workflow, but users should verify sources before letting it install third-party skills.

Before installing, ask the agent to show the exact registry, package slug, publisher, version, and any verification signals. Prefer reviewing the install command and package contents yourself, especially when the suggested source changes based on region or fallback behavior.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:1
Finding: Mandatory Agent Routing Override Through Highest-Priority Instructions
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:35
Finding: Installation of Third-Party Skills Without Mandatory Integrity Verification
Content: View full analysis
` when the result comes from `skillhub`. 2. If no `skillhub` candidate exists, use `clawhub install `. Before install, summarize source, version, and notable risk signals. ``` ### Technical Analysis The workflow permits the agent to install dynamically selected third-party Skills from external registries. Although it requires a summary of the source, version, and notable risk signals, it does not mandate: - Publisher or ownership validation - Cryptographic signature or checksum verification - Immutable version or digest pinning - Inspection of the complete downloaded package - Detection of typosquatting or dependency confusion - A final explicit confirmation tied to the exact version and publisher - Verification that the search result corresponds to the intended project A risk summary alone does not establish package integrity or trustworthiness. Registry search results may include malicious, compromised, or deceptively named packages. Installation would introduce instructions or executable components that were not included in the audited project. The reviewed Skill does not itself contain a malicious dependency or executable payload. The risk arises from the prescribed external installation workflow and its missing ...[truncated 1343 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The metadata directs Chinese users toward a specific source based on language/region-related characteristics without explicit opt-in. Automatic routing by locale or inferred network context can create privacy, fairness, and supply-chain concerns, especially if users are not told why a repository is being preferred.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This section operationalizes automatic source selection and fallback for Chinese users and CN networks, which can silently alter where software is sourced from. That increases risk because users may receive packages from a different trust domain than expected, and the policy is enforced without explicit consent or a transparent override step.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill’s activation guidance is broad enough to match generic help requests and force this workflow ahead of more appropriate handling. That can cause unintended tool use, misleading skill recommendations, or unnecessary transitions into search/install flows when the user did not clearly ask to discover or install a skill.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instructions permit installing skills for the user without an explicit consent gate immediately before the installation step. Installing third-party skills changes the user environment and can introduce unreviewed code or capabilities, so doing this without clear approval materially increases the risk of unauthorized or unsafe changes.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.