ClawHub
Back to skill

Security audit

Link Library

Security checks for vulnerabilities and agentic risk

Overview

This skill is a plausible personal link library, but it can persist full web content with too little confirmation and later reintroduce untrusted text into future agent context.

Install only if you are comfortable with the agent saving full copies of web content into a persistent local library. Use explicit save commands, avoid sharing private or sensitive links, and review stored entries before using them for writing because fetched pages or tweets may contain untrusted instructions or unwanted content.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T02 · Agent Memory Poisoning

Error
Location
SKILL.md:28
Finding

Persistent Agent Memory Poisoning Through Unsanitized Web Content

Content
View full analysis
Notable quotes worth highlighting ## Notes Personal observations, connections, action items. ## Related - [[library/tweets/related-tweet]] - [[library/articles/related-article]] ``` ```markdown **⚠️ MANDATORY: Always save original full text in "Original Content" section.** Summaries and key points are for quick retrieval. The original text is for accurate re-reading and quoting. Never skip saving the full content. ``` ```markdown ## Save Workflow 1. **Detect URL** — Parse link from user message 2. **Identify type** — Match URL pattern to content type 3. **Check dedup** — `memory_search("URL or title")` to avoid duplicates 4. **Fetch content** — Use appropriate method from table above 5. **Generate metadata** — Title, summary, key points, tags (3-7) 6. **Write entry** — Use template, fill frontmatter + full original text 7. **Confirm** — Tell user: title, tags, and where it's saved ``` `SKILL.md:179-185`: ```markdown ## Writing Reference Mode When user asks to write something using saved content: 1. Search library for relevant entries 2. Read full original text of top matches 3. Synthesize insights, cite sources inline 4. Format citations as `[[library/typ ...[truncated 3698 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Vague Triggers

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger conditions are extremely broad, causing the skill to activate and save content based on ordinary link sharing, mild positive reactions, or routine follow-up questions. This can lead to unintended persistence of user-shared material and surprise data retention, especially when the user did not clearly intend to store content.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill allows saving user-shared web content, including full original text, without presenting a privacy notice, retention policy, or user-facing warning about persistent storage. Because the content may include personal, copyrighted, or sensitive material, silent retention materially increases privacy, compliance, and trust risks.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

The documented 'Auto-save (no confirmation needed)' behavior gives the skill authority to persist data based on its own interpretation of user intent. In a knowledge-base skill that stores full content, autonomous persistence is risky because mistakes create durable privacy and data-retention consequences rather than transient conversational effects.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md
When user shares a link, evaluate interest signals:

**Auto-save (no confirmation needed):**
- User explicitly says save/bookmark/记一下/放进知识库
- User asks "帮我总结一下" (summarize implies save-worthy)

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill instructs fetching arbitrary Twitter/X user timelines for context, which goes beyond the user-provided URL and the stated purpose of saving specific shared content. This expands data collection without clear user consent and can pull in unrelated personal or sensitive content, increasing privacy and overreach risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.