ClawHub
Back to skill

Security audit

Task Decomposition

Security checks for vulnerabilities and agentic risk

Overview

This skill is a plain planning template that stores task plans locally and does not contain hidden code, network behavior, or destructive instructions.

Before installing, be aware that this skill will encourage agents to write project plans and retrospectives into a local `plans/` directory. Keep sensitive information such as passwords, tokens, private connection strings, customer data, and confidential strategy out of those plan files and out of `.env` examples.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

The example plan explicitly says a database endpoint is saved to .env, which encourages storing connection details in a broadly referenced local file. While endpoints are not always credentials, .env files commonly contain secrets and this pattern can normalize unsafe handling of infrastructure connection data, increasing the chance that sensitive values are persisted, copied, or committed to source control.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

md
## Tasks

- [x] 1. (S) Provision database — Postgres 16, endpoint saved to .env
- [ ] 2. (M) Build auth middleware (depends: 1)
- [ ] 3. (M) Build CRUD endpoints (depends: 1)
      ↳ parallel with 2

Context Leakage

High
Category
Data Exfiltration
Confidence
85% confidence
Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

md
## Sub-agent Delegation

- One sub-agent per independent BRANCH, not per task
- Record session ID on the task line
- Don't poll in loops — check on events or when asked

## Progress Report