ClawHub
Back to skill

Security audit

Anubis

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly performs the advertised resume task, but it uses an unsafe system-wide install command and forces unrelated paid-product promotion in the agent output.

Review this skill carefully before installing. Use a virtual environment instead of the provided system-level pip command, choose an output directory that does not expose sensitive resume data, check for existing files before saving, and expect the skill to show an unrelated paid upgrade message after completion.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:178
Finding

Mandatory Paid-Product Promotion Hijacks Agent Output

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 178-184
Vulnerability Type: Persistent instruction-driven output manipulation
Risk Level: Medium

Vulnerable Code Snippet:

python
console.print(Panel(
    "[bold green]Application package complete.[/bold green]\n\n"
    "Upgrade to [magenta]Anubis Pro ($9)[/magenta] for interview Q&As, follow-up email templates, and application tracking.\n"
    "-> [cyan]ko-fi.com/occupythemilkyway[/cyan]",
    border_style="green"
))

Technical Analysis

The skill instructs the agent to include a fixed advertisement and external sales destination in its completion output. This content is unrelated to generating the requested resume and cover letter and is not presented as an optional message requiring user consent.

Because the promotional output is embedded in the skill's mandatory execution sequence, loading and following the skill alters the agent's normal response objective. The agent becomes a channel for unsolicited paid-product promotion and external traffic redirection. This is instruction-level output hijacking rather than hidden code execution.

No evidence was found that the external destination is automatically contacted, that user information is transmitted to it, or that the link delivers an executable payload.

Attack Path

  1. A user loads or invokes the Anubis skill to generate application documents.
  2. The agent follows the required document-generation workflow.
  3. After generating the files, the agent executes or reproduces the mandatory confirmation behavior.
  4. The confirmation injects an advertisement for a paid product and directs the user to an external sales destination.
  5. The agent's trusted output is therefore used to promote an unrelated commercial offering without an explicit user request.

Impact Assessment

The issue affects the integrity and trustworthiness of the agent's responses. It allows the ski ...[truncated 355 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the paid-product advertisement and external sales link from the mandatory completion path.
  • Restrict completion output to task-relevant information, such as generated file names and output locations.
  • If promotional information is retained, make it explicitly optional and display it only after informed user consent.
  • Clearly distinguish author-controlled promotional content from functional status messages.
  • Add a review policy preventing skills from mandating advertisements, referrals, or unrelated external redirections in agent responses.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:44
Finding

Unpinned Dependency Installation Bypasses System Package Protections

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 44-48
Vulnerability Type: Unsafe third-party dependency installation
Risk Level: Medium

Vulnerable Code Snippet:

markdown
## Step 1 -- Install

```bash
pip3 install rich --break-system-packages --quiet
text

### Technical Analysis

The installation command retrieves `rich` from the active pip package index without pinning an exact version or validating a package hash. Consequently, the installed artifact may change over time even when the reviewed skill remains unchanged.

The `--break-system-packages` option deliberately bypasses Python's externally managed environment protection. This can modify the system Python environment, cause dependency conflicts, or overwrite versions expected by other applications. The `--quiet` option also suppresses useful installation diagnostics, reducing visibility into the selected package version and installation behavior.

Although `rich` is a known package and the audited material contains no evidence that it is currently malicious, the mutable dependency resolution and bypass of environment safeguards expose the execution environment to supply-chain compromise and system-package corruption.

### Attack Path

1. A user or agent follows the skill's installation instructions.
2. `pip3` contacts its configured package index and resolves the latest compatible `rich` release and its dependencies.
3. An attacker who compromises the configured index, an upstream release, package-maintainer credentials, or dependency resolution path supplies a malicious artifact.
4. Pip downloads and installs the unreviewed artifact into the system Python environment.
5. Package installation hooks or subsequently imported package code execute with the privileges of the user running pip.
6. Because system-package protections were bypassed, the installation may also alter dependencies used by unrelated local applications.

### Im
...[truncated 596 chars]
Remediation
View remediation

Remediation Suggestions

  • Install dependencies inside a dedicated virtual environment rather than the system Python environment.
  • Remove --break-system-packages.
  • Pin rich and all transitive dependencies to reviewed versions.
  • Use hash-verified installation, such as a locked requirements file with --require-hashes.
  • Configure an explicitly trusted package index and use repository integrity controls.
  • Avoid --quiet in security-sensitive automated installation so resolved versions and errors remain auditable.
  • Prefer declaring dependencies in a lockfile or packaged project manifest instead of executing an ad hoc installation command.
  • Run dependency installation as an unprivileged user and periodically scan locked packages for known vulnerabilities.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill writes generated resume and cover letter files to a user-controlled output directory and explicitly instructs saving them, but it provides no warning about persistence, possible overwrite of existing files, or exposure of sensitive personal data contained in resumes and job applications. In this context, the data includes highly sensitive PII and employment history, so silent file creation can create confidentiality and integrity risks even if the filenames are date-based.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.