ClawHub
Back to skill

Security audit

3123123123

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to help agents find and install other skills, but its vague name and broad activation rules under-disclose that capability-expanding behavior.

Review this skill before installing because it is framed as a capability-expansion helper but is published with non-descriptive metadata and broad triggers. It should be renamed/described clearly and should require explicit user intent before recommending or installing third-party skills.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding
The manifest advertises the skill with a meaningless name/description ('aa'), while the body describes a skill for discovering and installing other skills. This mismatch undermines transparency and reviewability, making it easier for risky capabilities to be hidden behind vague metadata and increasing the chance of accidental or unauthorized invocation.

Description-Behavior Mismatch

Medium
Confidence
98% confidence
Finding
The skill documentation states that it discovers and installs skills from an open ecosystem, but the manifest description remains the non-descriptive value 'aa'. This inconsistency can mislead users and automated governance controls, weakening trust and making security review of capability-granting skills harder.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The trigger conditions are very broad, covering common prompts like 'how do I do X' or 'can you do X', which could cause this skill to activate in many unrelated conversations. In the context of a skill that discovers and installs third-party capabilities, overbroad activation increases the risk of unsolicited tool discovery or expansion of agent capabilities without clear user intent.

Static analysis

No suspicious patterns detected.