ClawHub
Back to skill

Security audit

Writing Skills

Security checks for vulnerabilities and agentic risk

Overview

This is a skill-authoring guide with disclosed examples and helper scripts; its local skill-directory references are purpose-related rather than hidden or abusive.

Before installing, be aware that the skill encourages agents to inspect local skill directories during skill-discovery workflows. Use it with skill directories you trust, and review the duplicate frontmatter/version mismatch if parser compatibility matters.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Agent Config Directory Access

High
Category
Agent Snooping
Content
is at `~/.claude/skills/`.

Browse categories: `ls ~/.claude/skills/`
Search: `grep -r "keyword" ~/.claude/skills/ --include="SKILL.md"`

Instructions: `skills/using-skills`
</available_skills>
Confidence
91% confidence
Finding
The document instructs searching under `~/.claude/skills/`, which is inside an agent configuration area and may contain sensitive local instructions, private skills, or attacker-planted content. Encouraging recursive reads from user-local config directories can expose secrets or cause the agent to ingest untrusted prompt material that alters behavior.

Agent Config Directory Access

High
Category
Agent Snooping
Content
1. **Before starting:** Check for relevant skills
   - Browse: `ls ~/.claude/skills/`
   - Search: `grep -r "symptom" ~/.claude/skills/`

2. **If skill exists:** Read it completely before proceeding
Confidence
91% confidence
Finding
This line directs recursive searching of `~/.claude/skills/`, creating the same risk of reading sensitive or adversarial local content from a configuration path. In skill ecosystems, local directories are especially dangerous because an attacker or another process may plant malicious instructions that the agent then treats as authoritative.

Skill Enumeration

Medium
Category
Agent Snooping
Content
Your personal library of proven techniques, patterns, and tools
is at `~/.claude/skills/`.

Browse categories: `ls ~/.claude/skills/`
Search: `grep -r "keyword" ~/.claude/skills/ --include="SKILL.md"`

Instructions: `skills/using-skills`
Confidence
84% confidence
Finding
Enumerating `~/.claude/skills/` reveals the presence and taxonomy of locally installed skills, which can disclose capabilities, workflow focus, or internal tooling. While lower severity than direct content ingestion, this still leaks potentially sensitive operational metadata and primes the agent to trust whatever it finds there.

Skill Enumeration

Medium
Category
Agent Snooping
Content
THIS IS EXTREMELY IMPORTANT. BEFORE ANY TASK, CHECK FOR SKILLS!

Process:
1. Starting work? Check: `ls ~/.claude/skills/[category]/`
2. Found a skill? READ IT COMPLETELY before proceeding
3. Follow the skill's guidance - it prevents known pitfalls
Confidence
85% confidence
Finding
This instruction explicitly tells the agent to list category contents under a local skills path. That can leak environment-specific metadata and facilitates subsequent loading of untrusted local prompts, increasing the chance of prompt injection through planted skills.

Skill Enumeration

Medium
Category
Agent Snooping
Content
Your workflow for every task:

1. **Before starting:** Check for relevant skills
   - Browse: `ls ~/.claude/skills/`
   - Search: `grep -r "symptom" ~/.claude/skills/`
Confidence
84% confidence
Finding
Browsing `~/.claude/skills/` is a form of local capability enumeration and can expose sensitive metadata about the user's environment. In this context, the danger is amplified because the document is designed to pressure agents into checking skills under all conditions, reducing skepticism about what gets discovered.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.prompt_injection_instructions

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
render-graphs.js:72

Prompt-injection style instruction pattern detected.

Warn
Code
suspicious.prompt_injection_instructions
Location
SKILL.md:671