ClawHub
Back to skill

Security audit

agent-init

Security checks for vulnerabilities and agentic risk

Overview

This skill’s main AGENTS.md/CLAUDE.md generation behavior is understandable, but it also instructs agents to persist failure notes and propose changes to the skill itself, which expands its authority beyond the stated purpose.

Install only if you are comfortable with a skill that can create or rewrite project-level agent instruction files. Review any generated AGENTS.md or CLAUDE.md before committing it, and do not allow the self-evolution diary or SKILL.md PR behavior unless you explicitly want that maintenance workflow.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T02 · Agent Memory Poisoning

Warning
Location
SKILL.md:180
Finding

Persistent Self-Evolution Can Poison Future Skill Instructions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 180–186
Vulnerability Type: Persistent agent-state and instruction poisoning
Risk Level: Medium

Vulnerable Code

markdown
## Self-Evolution Mechanism

After each execution of this Skill:

1. Evaluate whether the output achieved the intended goal: **pass / fail**.
2. If it fails, reflect on the cause of failure and append a “failure case + improvement suggestion” to `diary/YYYY-MM-DD.md`.
3. If a certain improvement suggestion is repeatedly mentioned in the most recent three executions, refine it into a formal rule and submit a PR to modify this `SKILL.md`.

Technical Analysis

The Skill directs the agent to persist failure-derived suggestions in diary/YYYY-MM-DD.md, reuse that state across executions, convert repeated suggestions into formal rules, and submit a pull request modifying SKILL.md.

This behavior is not required for the declared purpose of generating or updating AGENTS.md or CLAUDE.md. Project-controlled content or deliberately induced failures could influence the recorded suggestions. Repetition can then promote those suggestions into trusted Skill instructions, causing untrusted observations to affect future sessions.

The pull-request instruction also creates an unexpected repository-changing side effect. Although the text does not explicitly bypass user authorization or platform review, it establishes a path by which execution-derived content can become persistent Skill behavior.

Attack Path

  1. An attacker controls or influences a project analyzed by the Skill.
  2. The attacker structures project content or conditions so executions fail in a predictable way.
  3. The agent records attacker-influenced failure analysis and improvement suggestions in diary/YYYY-MM-DD.md.
  4. The same suggestion is induced during the most recent three executions.
  5. Following the self-evolution instructions, the agent converts the repeated suggestion into a formal rule. ...[truncated 804 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the automatic self-evolution mechanism from SKILL.md.
  2. Do not persist failure-derived observations across executions by default.
  3. Present improvement suggestions only in the current response unless the user explicitly authorizes storage.
  4. Require separate, explicit approval before:
    • Creating or updating files under diary/
    • Modifying SKILL.md
    • Creating branches, commits, or pull requests
  5. Treat all project-derived observations as untrusted input and prohibit their direct promotion into Skill instructions.
  6. If a feedback process is necessary, store suggestions in a review-only format outside the executable instruction path and require manual validation by a trusted maintainer.
  7. Add provenance, sanitization, and human-review requirements for any proposed rule, and never automatically apply or merge such changes.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (8)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 186)May include surrounding context.

md
three executions, refine it into a formal rule and submit a PR to modify this `SKILL.md`.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description explains that the skill initializes or updates AGENTS.md/CLAUDE.md but does not clearly warn that this modifies project-root instruction files with persistent effect on future AI tool behavior. Users may invoke it without appreciating that it can overwrite or reshape high-trust configuration-like documentation, increasing the risk of unreviewed or unintended repository changes.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The invocation examples are broad enough to match ordinary documentation or setup requests, which can cause the skill to trigger in contexts the user did not explicitly intend. Because this skill writes or updates project-level instruction files that influence future agent behavior, accidental activation can lead to unintended persistent changes and potentially unsafe propagation of incorrect guidance.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The trigger description is broad enough to activate on vague requests such as 'create project rules' or 'setup agent guidelines,' which may not clearly mean the user wants AGENTS.md/CLAUDE.md generated or modified. Over-broad triggering can cause unintended execution and repository writes in contexts where the user did not consent to file creation or updates.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill directs creation or in-place modification of AGENTS.md/CLAUDE.md as part of its normal flow, but it does not require an explicit user-facing notice or confirmation that repository files will be changed. In an automated agent setting, silent writes can alter tracked documentation and overwrite hand-written content without sufficiently informed consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

Defaulting to Chinese when uncertain can cause the agent to generate documentation in a language the user or repository does not expect, leading to usability and governance issues. While not a direct security exploit, it increases the risk of confusing or effectively inaccessible documentation changes, especially when combined with automatic file writes.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The self-evolution section expands the skill's authority beyond generating or updating AGENTS.md/CLAUDE.md and instructs persistent writes to diary files plus PRs that modify the skill itself. This creates scope creep and a path for unauthorized repository changes, especially if execution is automated or the agent is granted broad write permissions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

These instructions authorize additional persistent changes outside the skill's stated purpose, including appending to diary files and submitting PRs that alter SKILL.md, without any warning or confirmation. Because they affect operational logic and audit history, they are more dangerous than the main document-generation behavior and can enable unauthorized policy drift over time.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.