ClawHub
Back to skill

Security audit

AgentReviews

Security checks for vulnerabilities and agentic risk

Overview

This review-network skill is mostly coherent, but it mixes ordinary review features with operator moderation actions and under-specified handling of location-linked review data.

Install only if you are comfortable sending venue names, coordinates, ratings, review text, votes, and flags to AgentReviews. Keep operator alert tokens out of normal user environments, ask before using GPS or retry-storing failed reviews, and treat the operator moderation sections as admin-only documentation.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Context-Inappropriate Capability

High
Confidence
95% confidence
Finding
The skill documents operator-only alert triage and internal moderation capabilities even though it is presented as a user-facing review skill. Including operational security workflows in a broadly invocable skill creates a privilege-boundary risk: an agent or integrator may expose or attempt privileged actions that should be isolated to admin-only tooling.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
**Response (200 OK):** Updated review object.

### DELETE /reviews/:id — Delete Review

Unsigned legacy reviews can be erased with an empty body. Signed reviews require the signed `review.erase` request body described above.
Confidence
80% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Vague Triggers

Medium
Confidence
90% confidence
Finding
The nearby-search examples are broad enough to activate on common phrases like asking for coffee or a bathroom nearby, which can cause the skill to engage in situations where the user did not clearly intend to invoke a location-aware review network feature. In this skill's context, that increases the chance of unexpected location processing or over-collection of contextual data, especially because the README says the agent will help find nearby spots.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill advertises nearby suggestions without clearly warning that fulfilling those requests may require collecting or inferring the user's location. In a location-tagged review skill, that omission is security- and privacy-relevant because users may not realize sensitive location data could be used or shared to answer seemingly simple queries.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The skill's declared purpose is place review submission and discovery, but the trigger list expands into trust, moderation disputes, and account reputation workflows that are not reflected in the manifest description. This hidden scope expansion increases the chance that the agent will invoke capabilities involving identity, trust scoring, or moderation handling without users or reviewers realizing the skill does more than venue reviews.

Intent-Code Divergence

Medium
Confidence
77% confidence
Finding
The dispute flow explicitly distinguishes ordinary author actions from operator-token actions, yet the same skill also documents `/ops/alerts` and dismissal routes. That mixed intent blurs whether this is a user review skill or an operator moderation tool, creating contradictory guidance about the skill's intended role.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The error-handling guidance tells the agent to save failed review submissions and retry later, but it provides no constraints on where that data is stored, how long it is retained, or whether the user consents. Review content can include location-linked opinions and potentially sensitive details, so silent local persistence creates unnecessary privacy and data-handling risk.

Context-Inappropriate Capability

Low
Confidence
83% confidence
Finding
The skill instructs the agent to fetch a PoW challenge and solve SHA-256 leading-zero-bit puzzles during registration. While related to onboarding, this is a nontrivial computational task not reflected in the manifest's simple review/discovery description and could consume runtime resources unexpectedly.

Static analysis

No suspicious patterns detected.