ClawHub
Back to skill

Security audit

AI Orchestrator V5

Security checks for vulnerabilities and agentic risk

Overview

This skill is a broad agent-routing guide with no executable code or hidden install behavior, but users should supervise its routing choices.

Install this only if you want a general-purpose agent router. Review which specialists it selects before sensitive work, and pay attention to checkpoint or session-memory behavior if your tasks involve private context.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
95% confidence
Finding
The invocation description is extremely broad for an orchestrator skill and lacks clear entry criteria or exclusion rules. This can cause the skill to activate on routine requests and seize control of routing decisions, increasing the chance of misdelegation, unintended tool/agent use, and over-privileged handling of user tasks.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The skill claims universal routing across a very large agent surface without meaningful constraints, which expands its authority and makes accidental or unsafe capture of user requests more likely. In context, this is more dangerous because it can direct work to many downstream specialists, magnifying errors, exposing more context than necessary, and bypassing least-privilege routing boundaries.

Static analysis

No suspicious patterns detected.