ClawHub
Back to skill

Security audit

meta-industry-chain-analysis

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a research workflow, but it includes persistent learning code that can write usage and preference data to arbitrary skill directories without clear containment or user controls.

Review this skill before installing if you do not want a skill to keep local usage history or preferences. If used, run the learner only against this skill's own directory, avoid putting sensitive notes in learner fields, and periodically inspect or delete learned_patterns.json.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding
The skill text describes persistent self-reflection, learner injection, and maintaining cross-session evolution, which is consistent with hidden file-write behavior despite no declared permissions. Undeclared write capability is dangerous because it can create or modify local state without user awareness, enabling covert persistence, data retention, or unexpected side effects in an otherwise research-oriented skill.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The declared purpose is industry-chain research, but the behavior includes maintaining learned_patterns.json, tracking usage outcomes, storing user preferences, and generating optimization insights. This mismatch is risky because it hides telemetry and persistence functions from operators, which can lead to undisclosed profiling, retention of sensitive workflow metadata, and trust-boundary violations.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The module accepts an arbitrary skill_dir and will read/write learned_patterns.json in that location, including resolving alternate paths under ~/.workbuddy/skills. This creates a filesystem write primitive outside the stated skill scope, which can tamper with other skills' state files or persist user preference/usage data across skills without clear authorization.

Static analysis

No suspicious patterns detected.