ClawHub
Back to skill

Security audit

Web Research Subagent

Security checks for vulnerabilities and agentic risk

Overview

This skill is a transparent web-research workflow with a small local scoring helper and no evidence of hidden persistence, exfiltration, or unsafe authority.

Install this when you want agents to perform disciplined web research with citations. Avoid using it for simple local-only tasks, and be careful not to include sensitive private context in delegated research prompts or web queries unless that is truly necessary.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The activation description is broad enough to trigger on many routine tasks involving current knowledge, research, or unfamiliar tools, which can cause unnecessary delegation and expanded exposure to untrusted web content. While the skill itself includes several safety-conscious instructions, overbroad invocation increases the chance that the agent uses this workflow when simpler, safer, or more context-limited handling would suffice.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
)
    args = parser.parse_args()

    positives = [name for name in WEIGHTS if getattr(args, name)]
    score = sum(WEIGHTS[name] for name in positives) + sum(RED_FLAGS[name] for name in args.red_flag)

    label = args.title or args.url or "candidate source"
Confidence
50% confidence
Finding
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Static analysis

No suspicious patterns detected.