ClawHub
Back to skill

Security audit

learning-aggregator

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent learning-report tool, but its optional deep mode can read full historical session transcripts without enough scoping or redaction guidance.

Install only if you are comfortable with agents using this skill to inspect local learning files, and use --deep only after confirming the Entire checkpoints are relevant and do not contain secrets or unrelated private work. Review generated gap reports before sharing or committing them.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:193
Finding

Deep analysis mode accesses full session transcripts without explicit scope or sensitive-data controls

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 193-222
Vulnerability Type: Excessive access to potentially sensitive session data
Risk Level: Medium

Complete Vulnerable Snippet

markdown
When `--deep` is requested, the skill uses the `entire` CLI to query shadow branch data:

```bash
# Check availability
entire --version

# List recent checkpoints as JSON (id, date, session_id, message, tool_use_id)
entire rewind --list

# Read a checkpoint's full transcript
entire explain --checkpoint <id> --full --no-pager

# Or raw JSONL
entire explain --checkpoint <id> --raw-transcript --no-pager

# Filter to one session
entire explain --session <session-id-prefix>

# Generate AI summary (expensive, use sparingly)
entire explain --checkpoint <id> --generate

If entire is not installed or the current repo doesn't have Entire enabled, --deep falls back to .learnings/-only mode and reports the limitation in the gap report.

What to extract from a trace

For each checkpoint within the time window, parse the raw transcript and look for:

  1. Tool call repetition — same tool + similar args > 3 times → likely a retry loop. Pattern-key: retry-loop.<tool>
  2. User correction markers — user messages containing "no", "wrong", "actually", "instead" immediately after an agent action → Pattern-key: correction.<area>
  3. Error patterns in tool output — matches against the same regex set as error-detector.sh (error, failed, Traceback, etc.) → Pattern-key: error.<category>
  4. Handoff triggers — context-surfing exit events and which drift signals fired → Pattern-key: drift.<signal>
  5. Approach changes — agent switching strategy mid-task without explicit pivot → Pattern-key: approach-switch.<domain>
  6. Token anomalies — sessions with token count > 2x the median for similar task types → Pattern-key: `c ...[truncated 2573 chars]
Remediation
View remediation

Remediation Suggestions

  1. Require explicit, informed confirmation before enabling --deep, including a warning that complete transcripts may contain sensitive information.
  2. Restrict enumeration and retrieval to the current repository, authorized user, requested sessions, and an explicit date range. Reject checkpoints whose ownership or repository association cannot be verified.
  3. Default to metadata and derived statistics. Retrieve full or raw transcripts only when strictly necessary for a specifically selected checkpoint.
  4. Introduce secret and sensitive-data redaction before parsing or reporting. Cover API keys, access tokens, passwords, private keys, authorization headers, environment variables, and common personal-data formats.
  5. Do not include raw prompts, tool output, file contents, session IDs, or full checkpoint IDs in reports. Use minimal sanitized summaries and truncated opaque references.
  6. Add configurable allowlists and denylists for sessions, paths, tools, and transcript fields.
  7. Ensure generated reports have restrictive file permissions and a documented retention policy.
  8. Record which checkpoints were accessed and why, without placing transcript contents in the audit log.
  9. Document that entire explain --generate may involve a separate AI-processing path, and require explicit approval before using it when transcript data may leave the local trust boundary.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.