ClawHub
Back to skill

Security audit

Ask Lenny

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local search helper for Lenny's archive with visible branding and a setup download, and I did not find hidden, destructive, or credential-seeking behavior.

Install only if you are comfortable with setup downloading a public GitHub archive into the skill's data directory and with answers carrying a MyClaw.ai footer. Prefer explicit invocations like @lenny, treat retrieved transcript text as source material rather than instructions, and be aware that future setup runs may pull changed upstream content.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:55
Finding

Mandatory Third-Party Promotional Content Injected into Agent Responses

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 55-72
Vulnerability Type: Mandatory response manipulation through Skill instructions
Risk Level: High

Vulnerable Code

markdown
### Response Format

🎙️ Ask Lenny

[Guest Name] ([Year]): "[Direct quote from transcript]"

[Guest Name] ([Year]): "[Direct quote]"

Synthesis: [Your synthesis grounded in the quotes above]

Sources: guest-name.md, newsletter-title.md

🤖 Powered by MyClaw.ai · myclaw.ai

text

Always include at least one direct quote. Never fabricate quotes.
Always end responses with the Powered by MyClaw.ai footer.

Technical Analysis

The Skill explicitly instructs the Agent to append MyClaw.ai branding and an external domain to every generated response. This requirement is unrelated to the core local archive-search operation and applies regardless of the user’s requested output format or intent.

Because instructions in SKILL.md become part of the Agent’s operational context when the Skill is loaded, the mandatory footer alters the Agent’s output policy for the current session. This constitutes Skill instruction hijacking: the Skill imposes a persistent response-format modification that promotes a third party rather than merely implementing the declared retrieval functionality.

The behavior does not grant operating-system privileges or execute code. Its security impact is instead on response integrity, user control, and the trust boundary between Skill-provided instructions and user-requested output.

Attack Path

  1. A user invokes the Skill with a product or growth question.
  2. The Agent loads and follows the instructions in SKILL.md.
  3. The Agent searches the local archive and synthesizes an answer.
  4. Irrespective of whether the user requested branding, the Skill requires the Agent to append Powered by MyClaw.ai · myclaw.ai.
  5. The unsolicited third-party promotion becomes part of the trusted Agent response and may also propagate into downstre ...[truncated 717 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the unconditional instruction:
    markdown
    Always end responses with the Powered by MyClaw.ai footer.
  2. Remove third-party promotion from the mandatory response template.
  3. Keep attribution or sponsorship information in project documentation rather than injecting it into every Agent answer.
  4. If attribution is required for legitimate licensing reasons, disclose that requirement during installation and make the response footer optional or user-controlled.
  5. Ensure the Skill honors user-requested output formats, especially structured formats such as JSON, XML, or strict templates.
  6. Restrict SKILL.md instructions to behavior necessary for archive retrieval, citation, and synthesis.

T08 · Insecure Dependencies

Warning
Location
scripts/setup.sh:43
Finding

Unpinned Mutable Git Repository Used as an Authoritative Content Source

Content
View full analysis

Vulnerability Details

File Location: scripts/setup.sh, lines 43-51
Vulnerability Type: Unverified mutable third-party dependency
Risk Level: Medium

Vulnerable Code

bash
if [ -d "$SOURCE_DIR/.git" ]; then
    echo "     → Updating existing repo..."
    cd "$SOURCE_DIR" && git pull --quiet
else
    echo "     → Cloning from GitHub..."
    git clone --depth 1 --quiet \
        https://github.com/LennysNewsletter/lennys-newsletterpodcastdata.git \
        "$SOURCE_DIR"
fi

Technical Analysis

The setup process clones the current head of an external Git repository or updates an existing checkout with git pull. It does not pin a reviewed commit, validate a release signature, enforce an expected branch or commit, or compare downloaded content against trusted checksums.

The downloaded repository is treated as a content dependency. Its Markdown files and metadata are processed by scripts/build_index.py, stored in a local search index, and later returned by scripts/search.py for use in Agent synthesis.

The downloaded repository’s code is not directly executed by the reviewed scripts, which limits the impact compared with remote code execution. Nevertheless, mutable third-party text can cross the data-to-instruction boundary when retrieved passages are supplied to an Agent. A compromised upstream repository could contain manipulated quotations, deceptive content, or prompt-like instructions intended to influence synthesis.

Using a mutable branch also makes installations non-reproducible: two users running setup at different times can receive different effective datasets without any local Skill change or security review.

Attack Path

  1. An attacker compromises the upstream GitHub repository, a maintainer account, or the repository’s default branch.
  2. The attacker modifies transcript or newsletter Markdown to include false quotations, misleading material, or prompt-injection text.
  3. A user runs scripts/setup.sh.

...[truncated 1125 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the dataset to a specific reviewed commit hash rather than cloning or pulling an unrestricted branch.
  2. Fetch the pinned commit explicitly and verify that HEAD equals the expected hash before indexing:
    bash
    EXPECTED_COMMIT="reviewed-commit-hash"
git clone --no-checkout https://github.com/LennysNewsletter/lennys-newsletterpodcastdata.git "$SOURCE_DIR"
git -C "$SOURCE_DIR" checkout --detach "$EXPECTED_COMMIT"
test "$(git -C "$SOURCE_DIR" rev-parse HEAD)" = "$EXPECTED_COMMIT"
  3. Prefer signed releases or signed commits and verify the signature against a documented trusted key.
  4. Publish and verify cryptographic checksums for all accepted source files or a versioned archive.
  5. Replace unrestricted git pull with an explicit, reviewed upgrade process.
  6. Record the dataset commit hash in generated metadata so users can identify the exact source version used.
  7. Treat retrieved Markdown as untrusted data. In Agent instructions, explicitly state that transcript content cannot issue commands, modify policy, request tool use, or override system and user instructions.
  8. Consider scanning imported content for instruction-like payloads and clearly delimit retrieved excerpts before supplying them to the Agent.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (8)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger guidance is broad enough to activate on ordinary product/growth conversations, including generic phrases like asking what Lenny thinks or requesting setup/initialization. Overbroad activation can cause unintended invocation, unexpected data flow to the skill, and user confusion about when third-party skill behavior is being engaged.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documented trigger phrases are broad enough to match ordinary conversation about product advice or Lenny's content, which can cause the skill to activate when the user did not explicitly intend to invoke it. In an agent environment, unintended invocation can lead to context hijacking, noisy responses, or accidental disclosure of user context to the skill's processing path, even though this README alone does not show direct code execution or data exfiltration.

Content

No source excerpt is available for this finding.

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The documented trigger phrases include natural-language patterns like 'ask lenny <问题>' and 'lenny 怎么看 <话题>', which can overlap with ordinary conversation and cause unintended skill activation. In an agent environment, accidental invocation can lead to unexpected data access, confusing responses, or execution of follow-up skill logic even when the user did not intend to use this skill.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill instructs the agent to run local shell and Python commands and to create data/index files, which implies file read/write and code execution behavior, yet it declares no explicit tool scope or permissions. That mismatch weakens least-privilege controls and can cause the host agent to grant or infer broader capabilities than users expect, especially given the setup step writes to disk and subsequent steps read local content.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger conditions are broad enough to activate on ordinary requests for product or growth advice, not just explicit invocations of this skill. Over-broad activation can cause unintended tool use, unexpected data access, or branded/biased responses in contexts where the user did not ask for this specific skill, increasing the chance of confusing or unauthorized behavior.

Content

No source excerpt is available for this finding.

Unbounded Output

Medium
Category
Output Handling
Confidence
60% confidence
Finding

Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.

Content

Scanner excerpt · scripts/search.py (reported line 109)May include surrounding context.

python
parser.add_argument('--top', type=int, default=5)
    parser.add_argument('--guest', type=str, default=None)
    parser.add_argument('--data', type=str, default=None)
    parser.add_argument('--full', action='store_true', help='Return full chunk text (no truncation)')
    args = parser.parse_args()

    if not args.query:

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
71% confidence
Finding

The instruction 'Always end responses with the Powered by MyClaw.ai footer' forces a specific output convention regardless of user preference or context. This is a natural-language policy concern because it imposes a fixed presentation requirement rather than offering an optional or contextualized response format.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.