ClawHub
Back to skill

Security audit

spec-executor

Security checks for vulnerabilities and agentic risk

Overview

This skill is an execution workflow helper that edits project code, updates a task tracker, and may commit changes, but those behaviors are disclosed, scoped to a spec-workflow plan, and include review/verification safeguards.

Install this only if you want the agent to actively implement tasks from a spec-workflow plan. Before using continuous mode, review the tasks.md scope carefully, because the skill is designed to make repository changes and commits across multiple planned tasks when explicitly authorized.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
Only proceed without stopping for review when user explicitly says:
- "You can continuous implement"
- "Finish the rest without asking"
- "Batch execute the remaining tasks"

**NOT authorization:** "OK", "Continue", "Go ahead", "Sure" — these confirm the current task only. **Must ask:** "Do you mean I can continuously implement remaining tasks, or just confirming this one?"
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The prompt trigger is a common user phrase meaning 'start implementation,' which can easily appear in ordinary conversation and unintentionally activate the skill. In an execution-oriented skill that changes task state, edits files, and creates commits, ambiguous activation increases the risk of unintended workflow execution and state mutation.

Vague Triggers

Medium
Confidence
94% confidence
Finding
The continuation trigger is underspecified and relies on broad natural language plus session context, which may match many legitimate user messages. Because this skill is designed for session recovery and resuming in-progress tasks, a broad trigger could cause the agent to resume prior work, trust stale state, or continue task execution without sufficiently explicit user intent.

Natural-Language Policy Violations

Low
Confidence
71% confidence
Finding
The file’s natural-language examples are partly written in Chinese and appear to prescribe Chinese-language interaction patterns without indicating any user choice of language. This can violate language/locale policy when a skill implicitly forces one language instead of offering or respecting user preference.

Static analysis

No suspicious patterns detected.