ClawHub
Back to skill

Security audit

Assetflow

Security checks for vulnerabilities and agentic risk

Overview

This skill is not malicious code, but it asks agents to perform broad cloud asset moves, tagging, indexing, sharing, and notifications without enough guardrails or privacy scoping.

Install only if you are comfortable granting this workflow access to cloud storage, DAM systems, and notification channels. Before use, require a dry run, narrow the target folders or buckets, confirm every write or archive action, disable OCR/AI analysis for sensitive repositories unless explicitly needed, and review what metadata or previews may be sent to Slack or third-party providers.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md
"files": ["SKILL.md"],

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 143)May include surrounding context.

md
AWS_REGION="us-east-1"

# Google Cloud (if using Google Drive)
GOOGLE_APPLICATION_CREDENTIALS="/path/to/credentials.json"

# Secondary integrations (optional)
ADOBE_XDM_API_KEY="adobe-api-key"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill is designed for bulk organization, folder creation, archival, and automated movement of assets, but the description and quick-start prompts do not prominently warn that these actions can affect large volumes of user data. In an agent setting, that omission increases the risk of accidental destructive or hard-to-reverse operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill promotes integrations with Slack, DAMs, and cloud providers, but it does not clearly warn that asset metadata, filenames, previews, or notifications may be transmitted to third-party services. This can expose sensitive business information, especially in creative, legal, or pre-release asset workflows.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The safety section makes a categorical claim that the skill never alters file contents, yet earlier examples explicitly mention generating thumbnails, previews, and proof sets. Even if those are derivative outputs rather than edits to originals, the documentation is internally inconsistent and can mislead users about what operations the workflow performs on their data.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The document claims sensitive files containing PII, passwords, or encrypted content are skipped, but other sections advertise OCR, object detection, and content analysis over assets. That creates an unsafe ambiguity: the system may need to inspect content to decide whether it is sensitive, which means users could wrongly assume sensitive materials are never processed or transmitted.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.