ClawHub
Back to skill

Security audit

executing-plans

Security checks for vulnerabilities and agentic risk

Overview

This skill is a transparent workflow aid for executing a written implementation plan step by step, with verification and stop-and-ask safeguards.

Install this if you want an agent to follow written implementation plans closely. Review any plan before execution, especially if it includes destructive commands, production changes, credential handling, or broad file operations; the helper script is a guide and still depends on honest manual verification.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The frontmatter description and the core compliance-layer instructions are written in Indonesian and present mandatory operating guidance for the skill, but the file does not state that Indonesian is optional or limited to a region-specific context. This creates a natural-language locale constraint that can conflict with organizational policy requiring user language choice or opt-in.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 182)May include surrounding context.

md
## Red Flags

**Never:**
- Skip verification steps
- Modify the plan without asking
- Continue past unclear instructions
- Guess at implementation details

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.

md
**Never:**
- Skip verification steps
- Modify the plan without asking
- Continue past unclear instructions
- Guess at implementation details
- Start on main/master without consent

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 186)May include surrounding context.

md
- Modify the plan without asking
- Continue past unclear instructions
- Guess at implementation details
- Start on main/master without consent

## Quick Reference

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 202)May include surrounding context.

md
- Review plan critically first
- Follow plan steps exactly
- Don't skip verifications
- Reference skills when plan says to
- Stop when blocked, don't guess
- Never start implementation on main/master branch without explicit user consent

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
88% confidence
Finding

The fallback path for plain numbered steps allows the operator to proceed by answering 'y' without the script capturing or validating any actual verify command or result. This weakens the script's stated safety guarantee of enforced verification and could let unverified or unsafe plan steps be marked as completed based solely on human affirmation, especially if the plan content is adversarial or misleading.

Content

Scanner excerpt · scripts/run_plan.sh (reported line 56)May include surrounding context.

sh
step_no=$((step_no + 1))
    echo "--- STEP $step_no (plain): $line ---"
    if [ -t 0 ]; then exec 3<&0; else exec 3</dev/tty 2>/dev/null || exec 3<&0; fi
    echo "  No verification matrix found. Supply a verify command to proceed [y/N]: "
    read -r ans <&3
    case "$ans" in
      y|Y) echo "  [ok] step $step_no recorded (verify provided manually)" ;;

Static analysis

No suspicious patterns detected.