ClawHub
Back to skill

Security audit

HiFi Advisor

Security checks for vulnerabilities and agentic risk

Overview

This skill provides audio buying, setup, and used-price guidance with a small local CSV helper and no hidden access, persistence, or data sharing.

Installers should understand that this skill may ask for purchase context, room details, existing audio gear, and listing-price data. Use the CSV helper only with listing data you are comfortable processing locally; no evidence shows it sends data elsewhere.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The activation guidance says to use this workflow when the user asks "what should I buy" or "is X + Y a good match," which are common, broadly phrased questions. The file does not add scope constraints or negative examples to limit invocation to a specific domain, increasing the chance of unintended triggering.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The phrases "how to place," "why bass boomy," and "how to tune" are not sufficiently bounded and could match general questions outside the intended audio setup context. No negative examples or explicit context limitations are provided to distinguish when this template should or should not be used.

Vague Triggers

Medium
Confidence
89% confidence
Finding
The trigger examples "is this listing worth it" and "what is fair price" are generic marketplace questions that commonly occur in many contexts. Because the file does not explicitly restrict them to used audio equipment or provide exclusions, the trigger scope is overly broad.

Static analysis

No suspicious patterns detected.