ClawHub
Back to skill

Security audit

adserFB3

Security checks for vulnerabilities and agentic risk

Overview

This ads-management skill is mostly coherent, but it gives the assistant broad automatic authority over sensitive business workflows with weak scoping and unsafe credential guidance.

Review this before installing if the connected tools can read ad accounts, approve proposals, publish content, or change Meta settings. It should be limited to explicit ads commands, require confirmation for writes and publishing, avoid storing free-form instructions, and move access-token setup to a secure settings flow.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:3
Finding

Global Instruction Hijacking and Safety-Response Suppression

Content
View full analysis
Remediation
View remediation

T02 · Agent Memory Poisoning

Warning
Location
SKILL.md:49
Finding

Unvalidated Persistent Storage of Sender-Controlled Instructions

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Vague Triggers

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifest description says the skill 'MUST trigger for every message from boss,' creating an extremely broad activation scope. That increases the chance the skill will intercept unrelated messages and autonomously invoke tools or actions in contexts where the user did not explicitly request them, especially given the zero-question policy elsewhere in the file.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

The explicit directive to act 'WITHOUT asking' is a form of autonomous decision-making that bypasses normal confirmation and clarification safeguards. In this skill, that autonomy is more dangerous because it is paired with mandatory triggering and direct tool invocation, increasing the likelihood of unnecessary data access or unintended operational behavior.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

MORNING BRIEF (7:00–9:00 AM Vietnam time)

On first message of the day → automatically call WITHOUT asking:

text
ads_manager_brief(mode: "report")

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill instructs the assistant to automatically call reporting and alert tools on the first morning message 'WITHOUT asking,' which causes proactive data access and processing without an explicit request at that moment. In a boss-facing skill tied to ads data, this can expose sensitive business metrics or normalize silent tool execution without transparency.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The communication policy requires 'Language: Vietnamese (unless boss writes English)' and mandates addressing the user as 'Sếp' while forbidding other forms of address. This is a locale/language policy constraint imposed by default rather than offered as a user choice or clearly justified as a region-specific requirement.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The guidance explicitly includes meta.accessToken: <token> and related secret-bearing configuration fields in chat-facing instructions. Even though shown as an example, this pattern encourages requesting, pasting, or exposing live credentials in conversation, which can lead to secret leakage through chat logs, transcripts, or accidental sharing.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.