Security audit

Skill Scaffold

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent scaffolding CLI, but its generated MCP configuration and unsanitized generated skill metadata create review-worthy supply-chain and prompt-injection risks.

Install only if you are comfortable with a template generator that writes project files. Review generated SKILL.md files before publishing or installing them, avoid passing untrusted text into --author or --description, and replace generated MCP npx configs with a pinned version, --no-install, or a verified local executable path before adding them to Claude, Cursor, or another MCP client.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: bin/skill-scaffold.js:108
Finding: Unescaped Metadata Injection into Generated Agent Instructions
Content: View full analysis
`--- name: ${skillName} description: ${description} author: ${author} version: 1.0.0 keywords: - ai - automation - clawdbot ``` The description is also inserted into the Markdown body without encoding: ```javascript # ${titleCase(skillName)} ${description} ``` ### Technical Analysis The `--description` and `--author` arguments accept arbitrary strings without rejecting line breaks, YAML control syntax, Markdown directives, or instruction-like content. These values are interpolated directly into YAML frontmatter and the body of a generated `SKILL.md`. An attacker who can influence the scaffold command arguments can terminate or restructure the intended YAML value by supplying newline characters. The attacker can then add arbitrary frontmatter fields, Markdown sections, or instructions that become persistent content in the generated Skill. Because `SKILL.md` is intended to be consumed by AI agents, injected content can influence an agent when the generated Skill is later installed or loaded. The generator does not itself execute the injected content, but it creates a trusted-looking artifact containing attacker-controlled instructions. ### Attack Path 1. An attacker influences a developer, build script, wrapper, or automation system to invoke the CLI with a crafted `--description` or `--author` value. 2. The crafted value cont ...[truncated 985 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: bin/skill-scaffold.js:203
Finding: Generated MCP Configuration Executes an Unpinned Registry Package
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.
md
## After Creating 1. `cd my-skill` 2. Edit SKILL.md with your actual documentation 3. Add implementation (scripts or bin/) 4. Test locally 5. Publish: `clawdhub publish .` or `npm publish`

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · bin/skill-scaffold.js (reported line 418)May include surrounding context.
js
## After Creating 1. `cd my-skill` 2. Edit SKILL.md with your actual documentation 3. Add implementation (scripts or bin/) 4. Test locally 5. Publish: `clawdhub publish .` or `npm publish`

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The trigger list contains broad phrases like 'create a skill' and 'skill generator' that can match common user requests outside the intended scope. In agent ecosystems where skills auto-activate from natural language, this can cause accidental invocation, unexpected file generation, or privilege-bearing tool use in contexts the user did not explicitly intend.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This code creates directories, writes multiple files, and changes file permissions, which are user-affecting filesystem operations. While the CLI usage shows an output directory option, there is no explicit warning, confirmation, or pre-action disclosure that running the command will create a new project structure on disk.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.