ClawHub
Back to skill

Security audit

Phy Linkedin Gtm

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed LinkedIn content-strategy guide with no code, persistence, credential use, or automatic posting behavior.

Installers should understand that the skill may prompt the agent to browse or search LinkedIn-related public content for inspiration. Review generated posts before publishing and specify your preferred language when drafting multilingual content.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Vague Triggers

Medium
Confidence
95% confidence
Finding
The trigger description is broad enough to activate on generic professional networking or B2B content requests, which can cause the skill to be selected outside its intended scope. Over-broad activation increases prompt injection and policy-conflict risk because a marketing-oriented workflow may override more appropriate task handling in unrelated contexts.

Natural-Language Policy Violations

Medium
Confidence
94% confidence
Finding
The example shows a Chinese user request being answered in English without any indication of user preference, implying a fixed-language output policy. This can cause the agent to ignore explicit or implicit language expectations, leading to degraded usability, miscommunication, and unsafe task execution if nuance is lost in translation.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
A second Chinese-input-to-English-output example reinforces a hardcoded English response pattern rather than a contextual language choice. Repetition makes the behavior more likely to be learned and applied broadly, increasing the chance of user-intent mismatch and incorrect communication in multilingual scenarios.

Unbounded Output

Medium
Category
Output Handling
Content
(And what to do instead)

Slide 2:
The promise: "Generate unlimited content"
The reality: Everything looks the same

Slide 3:
Confidence
80% confidence
Finding
Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.

Static analysis

No suspicious patterns detected.