ClawHub
Back to skill

Security audit

Orche

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed multi-agent workflow orchestrator, with expected state files and agent spawning, but it should be invoked deliberately because it can spend tokens and write workspace deliverables.

Install this only if you want a workflow that can create multiple sub-agent sessions, write workspace/orche-* files, and continue into execution after initial requirements approval. For high-risk or expensive tasks, invoke it explicitly with /orche and request approval at each step.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
85% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 563)May include surrounding context.

md
> These principles reflect lessons learned in production.

- ✅ Read only `watchdog.md` → query `sessions_list` using `session_keys`
- ✅ Do not judge failure by "no session" alone — if deliverables/state files exist, assume progress/completion first
- ✅ Judge normal termination only when: no tasks + 0 active sessions
- ⚠️ If anything is active, report status and wait

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The trigger phrases include very broad natural-language terms like "orchestrate," "orchestration," and "systematic execution," which can cause the skill to activate unintentionally during ordinary conversation. Because this skill is a multi-agent orchestrator that can spawn sub-agents and drive autonomous workflow phases, accidental invocation increases the chance of unintended task execution and resource consumption.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

md
|---------|---------|--------|
| **Hallucination** | Uses non-existent APIs/libraries | Non-executable code |
| **Execution without planning** | Starts writing code immediately | Direction change costs explode |
| **No verification** | Deliverables "look plausible" | Don't actually work |
| **Linear-only progression** | Keeps going forward even on failure | Root cause unresolved |
| **Cost explosion** | Indiscriminate agent deployment | Budget exhaustion |

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.

bash
# Copy to skills directory
mkdir -p ~/.agents/skills/orche
cp SKILL.md ~/.agents/skills/orche/SKILL.md

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 143)May include surrounding context.

bash
# Copy to skills directory
mkdir -p ~/.agents/skills/orche
cp SKILL.md ~/.agents/skills/orche/SKILL.md

Step 2: Trigger (10 Seconds)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documentation explicitly allows ambiguous natural-language activation (e.g. "Orchestrate this project systematically"), which lowers invocation precision and makes accidental activation more likely. In the context of a skill that performs planning, execution, file writes, and sub-agent spawning, ambiguous activation can initiate powerful actions without sufficiently deliberate user intent.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 963)May include surrounding context.

  1. Install hallucination-guard skill:
    bash
    # Install from ClawHub (needs verification: install command may vary by environment)
mkdir -p ~/.agents/skills/hallucination-guard
# Place SKILL.md in that directory

Static analysis

No suspicious patterns detected.