ClawHub
Back to skill

Security audit

testmuy

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed local learning log with an optional OpenClaw hook that stores short error excerpts for later triage, so it is useful but should be treated as retaining potentially sensitive workspace data.

Install this only in workspaces where you are comfortable keeping a local .learnings history. Keep .learnings out of version control unless you intentionally want to share it, review auto-swept errors before relying on them, and enable the hook only if transcript-derived error capture is acceptable for the workspace.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill contains commands and workflows that use shell execution, filesystem writes, git clone, and cross-session features implying network and environment access, but it does not declare any permissions or trust boundaries. This creates a transparency and consent problem: a user or host may authorize the skill based on its description without realizing it can reach outside simple local note-taking behavior.

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding
The documented purpose is simple learning capture, but the skill also describes transcript sweeping, bootstrap context injection, pending-triage surfacing, and skill extraction/scaffolding. That mismatch increases the chance that operators approve or invoke the skill under a narrower trust model than its actual behavior, enabling unintended collection, persistence, and propagation of session data.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The skill explicitly instructs use of tools to list sessions, read other sessions' transcripts, send messages across sessions, and spawn sub-agents. Even though it says to use these only in trusted environments and with explicit user intent, the capability materially expands the data-access boundary beyond local learning capture and can expose sensitive transcript content or enable lateral propagation of prompts and data.

Context-Inappropriate Capability

Medium
Confidence
82% confidence
Finding
The skill includes automated extraction of a new reusable skill from logged learnings, including helper-script execution and creation of new SKILL.md content. This expands the blast radius from passive logging to generating executable prompt artifacts, which can persist mistakes, unsafe patterns, or poisoned guidance into future sessions if entries are untrusted or insufficiently reviewed.

Session Persistence

Medium
Category
Rogue Agent
Content
## Opt-In and Safety

- The sweep only runs when `<workspace>/.learnings/` exists — create that
  directory to enable it, delete it to disable it
- `ERRORS.md` is created only if missing and is otherwise appended to, never
  overwritten
Confidence
86% confidence
Finding
The hook persists excerpts from prior session transcripts into a long-lived `.learnings/ERRORS.md` file, creating cross-session retention of operational data. Although the document claims truncation and redaction, transcript-derived error text can still contain sensitive internal paths, commands, prompts, or partially missed secrets, and persistence increases exposure and unintended reuse across future sessions.

Static analysis

No suspicious patterns detected.