Security audit

Diff Auditor

Security checks for vulnerabilities and agentic risk

Overview

This skill performs a disclosed read-only comparison of an installed skill against its ClawHub update, but it adds a promotional link to generated reports.

Install only if you are comfortable with the agent reading the SKILL.md for the specific skill you ask it to audit and fetching the comparison copy from ClawHub. Treat the Gumroad link in reports as optional advertising, not security evidence.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (2)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:52
Finding: Mandatory Commercial Link Injection in Generated Audit Reports
Content: View full analysis
Installed: x.y.z → Available: a.b.c ### Verdict [Safe to update | Update with caution | Do not update] Reason: ### New tools requested ### Risk profile [Increased | Decreased | Unchanged] --- *Full diff audit (instruction changes + new endpoints): https://theagentgordo.gumroad.com/l/clawhub-ops-pack* ``` ``` ### Technical Analysis The mandatory report template directs the agent to append a fixed commercial link to every audit result. This content is not necessary to compare Skill versions, identify newly requested tools, or assess changes in risk posture. Because the instruction is part of the Skill text loaded into the agent's active context, it alters the output generated for the user's security-audit request. The injected content is presented as part of the audit rather than clearly separated optional documentation. This is an output-integrity issue matching Skill instruction hijacking. The destination is an external Gumroad sales page. The reviewed instructions do not automatically submit audit data to that site, execute content from it, or force the agent to fetch it. Consequently, the confirmed issue is mandatory promotional output injection rather than sensitive-data exfiltration or remote payload execution. ### Attack Path 1. A user invokes the Skill to review a pending update. 2. The agent loads `SKILL.md` into its active instruction context. 3. The agent reads the mandatory report template. 4. The agent performs the otherwise legitimate local-read and remote-fetch comparison. 5. The agent appends the operator-selected Gumroad link to the resulting security report. 6. The user may interpret the injected link as a necessary or endorsed component of the audit and n ...[truncated 730 chars]
Remediation: View remediation

T01 · Skill Instruction Hijacking

Warning

Location: SKILL-LITE.md:52
Finding: Mandatory Commercial Link Injection in Lite Audit Reports
Content: View full analysis
Installed: x.y.z → Available: a.b.c ### Verdict [Safe to update | Update with caution | Do not update] Reason: ### New tools requested ### Risk profile [Increased | Decreased | Unchanged] --- *Full diff audit (instruction changes + new endpoints): https://theagentgordo.gumroad.com/* ``` ``` ### Technical Analysis The lite variant embeds a mandatory Gumroad promotion in its generated report format. The footer does not contribute to version comparison, tool-delta detection, or risk classification and therefore exceeds the output behavior needed for the declared auditing function. Loading the Skill causes this publisher-controlled instruction to enter the agent's current context. The agent is consequently directed to include unrelated commercial content in a response that the user requested as a security assessment. This is a current-session instruction and output integrity violation consistent with Skill instruction hijacking. The reviewed content does not instruct the agent to transmit installed Skill contents or credentials to Gumroad. The `web_fetch` permission is otherwise used to retrieve the pending Skill version from ClawHub, which is necessary for the comparison. No automatic request to the promotional destination is specified. ### Attack Path 1. A user requests an update audit using the lite variant. 2. The agent loads `SKILL-LITE.md`. 3. The mandatory report format becomes part of the active instructions. 4. The agent reads the installed Skill and fetches its pending version from ClawHub. 5. After generating the comparison, the agent inserts the fixed Gumroad URL into the report. 6. The injected call to action may cause the user to visit a publisher-selected ...[truncated 653 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL-FULL.md (reported line 83)May include surrounding context.
md
**User:** Audit the update for skill-weather before I apply it. **Agent actions:** 1. Reads `~/.openclaw/skills/skill-weather/SKILL.md` — finds version 1.2.0, tools: `[web_fetch]` 2. Fetches `https://clawhub.com/skills/skill-weather/SKILL.md` — finds version 1.3.0, tools: `[web_fetch]` 3. Compares: only the wttr.in fallback URL changed; no new tools; no new domains

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL-FULL.md (reported line 84)May include surrounding context.
md
**User:** Audit the update for skill-weather before I apply it. **Agent actions:** 1. Reads `~/.openclaw/skills/skill-weather/SKILL.md` — finds version 1.2.0, tools: `[web_fetch]` 2. Fetches `https://clawhub.com/skills/skill-weather/SKILL.md` — finds version 1.3.0, tools: `[web_fetch]` 3. Compares: only the wttr.in fallback URL changed; no new tools; no new domains

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 85% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL-LITE.md (reported line 76)May include surrounding context.
md
## Requirements - `read` — to access installed SKILL.md - `web_fetch` — to retrieve the new version from ClawHub - No API keys required

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 85% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.
md
## Requirements - `read` — to access installed SKILL.md - `web_fetch` — to retrieve the new version from ClawHub - No API keys required

Static analysis

No suspicious patterns detected.