ClawHub
Back to skill

Security audit

VAM Scripter

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent VAM scripting reference with example scripts; its local state and file operations are disclosed and fit the stated purpose.

Install only if you want VAM Scripter documentation and example scripts. Before copying examples into VAM, review any use of fs.writeSceneFileSync or fs.unlinkSceneFileSync because those can save, overwrite, or delete scene-local files, and verify atom names, audio clips, and keybindings match your scene.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 316)May include surrounding context.

md
- `SKILL.md` - This documentation

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/state-persistence.js (reported line 68)May include surrounding context.

js
}
});

// Save state to file
function saveState() {
    try {
        fs.writeSceneFileSync(statePath, JSON.stringify(appState, null, 2));

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

This markdown file documents a state-persistence.js example that saves and loads state across sessions and also lists an fs module for file system operations. The README does not include any warning that these behaviors may write data or persist changes, which is relevant user-facing disclosure for a markdown skill description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

This markdown file documents file-system persistence using fs.writeSceneFileSync and fs.readSceneFileSync, which can affect user data by storing and overwriting scene-specific files. The example presents the behavior as a normal pattern but does not warn users that script state will be written to disk or describe persistence implications.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The introductory sentence includes Chinese text (实用) inside an otherwise English document, which imposes mixed-language content without user opt-in or explanation. This can violate language/locale policy where skills are expected to present language consistently unless a choice or justification is provided.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The state persistence example writes state.json on disable via fs.writeSceneFileSync, which affects user data on disk. In this markdown description, there is no warning or note that the pattern persists data locally, so readers are not alerted to the side effect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

This markdown file documents fs.unlinkSceneFileSync(path) with the brief description 'Deletes a file' and an example invocation, but it does not include any cautionary note about data loss or irreversible deletion. Under the markdown-specific SQP-2 criteria, destructive behavior that can affect user data should be accompanied by a warning.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The inline comment says the sound is played 'if collision detected', but the actual condition at L18 is a distance threshold check, not a collision test. This is an intent-level documentation mismatch because it describes a different interaction model than the implemented behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.