ClawHub
Back to skill

Security audit

Writing Skills

Security checks for vulnerabilities and agentic risk

Overview

This is a skill-authoring guide with disclosed examples and helper scripts; its local skill-directory references are purpose-related rather than hidden or abusive.

Before installing, be aware that the skill encourages agents to inspect local skill directories during skill-discovery workflows. Use it with skill directories you trust, and review the duplicate frontmatter/version mismatch if parser compatibility matters.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
91% confidence
Finding

The document instructs searching under ~/.claude/skills/, which is inside an agent configuration area and may contain sensitive local instructions, private skills, or attacker-planted content. Encouraging recursive reads from user-local config directories can expose secrets or cause the agent to ingest untrusted prompt material that alters behavior.

Content

Scanner excerpt · examples/CLAUDE_MD_TESTING.md (reported line 95)May include surrounding context.

md
is at `~/.claude/skills/`.

Browse categories: `ls ~/.claude/skills/`
Search: `grep -r "keyword" ~/.claude/skills/ --include="SKILL.md"`

Instructions: `skills/using-skills`
</available_skills>

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
91% confidence
Finding

This line directs recursive searching of ~/.claude/skills/, creating the same risk of reading sensitive or adversarial local content from a configuration path. In skill ecosystems, local directories are especially dangerous because an attacker or another process may plant malicious instructions that the agent then treats as authoritative.

Content

Scanner excerpt · examples/CLAUDE_MD_TESTING.md (reported line 123)May include surrounding context.

md
1. **Before starting:** Check for relevant skills
   - Browse: `ls ~/.claude/skills/`
   - Search: `grep -r "symptom" ~/.claude/skills/`

2. **If skill exists:** Read it completely before proceeding

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
84% confidence
Finding

Enumerating ~/.claude/skills/ reveals the presence and taxonomy of locally installed skills, which can disclose capabilities, workflow focus, or internal tooling. While lower severity than direct content ingestion, this still leaks potentially sensitive operational metadata and primes the agent to trust whatever it finds there.

Content

Scanner excerpt · examples/CLAUDE_MD_TESTING.md (reported line 94)May include surrounding context.

md
Your personal library of proven techniques, patterns, and tools
is at `~/.claude/skills/`.

Browse categories: `ls ~/.claude/skills/`
Search: `grep -r "keyword" ~/.claude/skills/ --include="SKILL.md"`

Instructions: `skills/using-skills`

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

This instruction explicitly tells the agent to list category contents under a local skills path. That can leak environment-specific metadata and facilitates subsequent loading of untrusted local prompts, increasing the chance of prompt injection through planted skills.

Content

Scanner excerpt · examples/CLAUDE_MD_TESTING.md (reported line 107)May include surrounding context.

md
THIS IS EXTREMELY IMPORTANT. BEFORE ANY TASK, CHECK FOR SKILLS!

Process:
1. Starting work? Check: `ls ~/.claude/skills/[category]/`
2. Found a skill? READ IT COMPLETELY before proceeding
3. Follow the skill's guidance - it prevents known pitfalls

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
84% confidence
Finding

Browsing ~/.claude/skills/ is a form of local capability enumeration and can expose sensitive metadata about the user's environment. In this context, the danger is amplified because the document is designed to pressure agents into checking skills under all conditions, reducing skepticism about what gets discovered.

Content

Scanner excerpt · examples/CLAUDE_MD_TESTING.md (reported line 121)May include surrounding context.

md
Your workflow for every task:

1. **Before starting:** Check for relevant skills
   - Browse: `ls ~/.claude/skills/`
   - Search: `grep -r "symptom" ~/.claude/skills/`

Static analysis

Detected: suspicious.dangerous_exec, suspicious.prompt_injection_instructions

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
render-graphs.js:72

Prompt-injection style instruction pattern detected.

Warn
Code
suspicious.prompt_injection_instructions
Location
SKILL.md:671