ClawHub
Back to skill

Security audit

hypothesis-driven-inquiry

Security checks for vulnerabilities and agentic risk

Overview

The skill’s core local hypothesis-ranking tool is coherent, but it also asks agents to keep cross-session learning state and potentially rewrite the installed skill without clear user consent or retention controls.

Install only if you are comfortable with this skill keeping local usage history and preferences in its directory, and with agents potentially changing the skill’s own instructions after repeated errors. Avoid using it with sensitive diagnostic details unless you first disable or remove the learner workflow and clear learned_patterns.json when done.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill advertises zero-dependency local reasoning but also instructs use of a learner module that writes persistent state to disk, creating undeclared file-write capability. Undeclared persistence can surprise operators, bypass least-privilege review, and enable retention of sensitive prompts, observations, or user preferences beyond a single run.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The documented purpose is hypothesis-driven inquiry, but the skill also performs behavioral logging, preference storage, and self-optimization via learned state. This mismatch is dangerous because users may provide sensitive diagnostic data under the assumption it is used transiently, while the skill actually retains and repurposes it across sessions.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The markdown states that operation counts, error patterns, user preferences, and improvement suggestions are stored, but it does not provide any privacy warning, consent flow, retention limit, or handling guidance. That creates a real data-governance risk because users may unknowingly persist sensitive workflow details or personal preferences to local files.

Ssd 3

Medium
Confidence
93% confidence
Finding
The skill explicitly instructs persistence of important user preferences for automatic reuse in future sessions, which establishes cross-session memory without clear consent boundaries. This can expose sensitive preferences or behavioral data over time and increases the blast radius if the local state file is accessed by other tools, users, or processes.

Static analysis

No suspicious patterns detected.