ClawHub
Back to skill

Security audit

skill-factory

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed skill-building template with no executable code or network behavior, though users should review any generated skills before installing them.

Install only if you want an agent to help draft OpenClaw skills. Before enabling any skill it generates, review the generated SKILL.md for narrow triggers, anti-triggers, permission needs, data handling, external services, and side effects.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

This meta-skill explicitly instructs the agent to create new SKILL.md files with purpose, triggers, directives, and reasoning protocols, which is a form of prompt-bearing artifact generation. In context, that is more dangerous than ordinary content generation because it can replicate unsafe activation logic, embed overbroad authority, or mass-produce insecure skills that later influence agent behavior.

Content

Scanner excerpt · README.md (reported line 50)May include surrounding context.

md
→ Output system design

### Fase 3: Core Building
→ Write SKILL.md (the brain)
→ Define purpose, triggers, directives
→ Install reasoning protocols
→ Set quality standards

Vague Triggers

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The description says to use this skill whenever a new skill is needed across virtually any domain, making activation criteria extremely broad. In agentic systems, such vague triggers can cause unintended invocation on ordinary planning or content-generation requests, unexpectedly shifting the agent into skill-authoring behavior and increasing the chance of unsafe file changes or privilege overreach.

Content

No source excerpt is available for this finding.

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

md
→ Design the output system

PHASE 3: CORE BUILDING
  → Write SKILL.md (the brain)
  → Define purpose, triggers, directives
  → Install reasoning protocols
  → Set quality standards

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The skill description is written as an instruction set in Indonesian ('Skill meta-level yang mengubah agent...') with no indication that users may choose another language. Under the policy, a skill should not impose a language or locale without opt-in unless the regional constraint is clearly justified.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The invocation examples are broad, generic requests such as creating skills for common domains, which can overlap with ordinary user intents and cause the meta-skill to activate when the user may have only wanted direct task assistance. In a skill that generates other skills, unintended activation increases the chance of producing overly powerful prompt artifacts, including unsafe instructions propagated into downstream skills.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The guardrails are written in Indonesian ('Wajib', 'JANGAN', 'Bukan'), which introduces a locale-specific instruction block without any user opt-in or bilingual fallback. This can cause inconsistent interpretation by agents or operators, and safety-critical constraints may be missed or only partially understood in mixed-language environments.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill explicitly lists an implicit trigger of 'User mentions pain points' without defining scope, domain boundaries, or exclusion criteria. In a meta-skill that creates other skills, this can cause over-broad activation and unintended behavior, including generating or applying the factory in contexts the user did not clearly request.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The template defines a generic 'TRIGGER DETECTION' stage but provides no mandatory activation criteria, scope boundaries, or explicit non-trigger conditions. In a meta-skill that is meant to generate other skills, this omission can propagate unsafe activation logic into downstream skills, causing over-broad invocation, context confusion, or unintended execution in sensitive workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README template includes overview, installation, usage, and features, but it does not require any warnings about data handling, privacy implications, tool side effects, or system-impacting behavior. Because this is a factory template for producing new skills, the omission can systematically normalize undocumented risk in derivative skills, leading users to run skills without understanding collection, persistence, external calls, or operational consequences.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest description is written entirely in Indonesian, which implies a specific language/locale for the skill metadata without any indication that users can choose another language. The policy calls for flagging language or locale constraints when they are imposed without user opt-in or clear justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.