ClawHub
Back to skill

Security audit

copywriting-hooks

Security checks for vulnerabilities and agentic risk

Overview

This copywriting skill is not malicious, but it asks for file-editing, broad search, and agent-delegation powers that do not fit its stated hook/title-writing job.

Review before installing. The content appears to be ordinary copywriting guidance with no exfiltration, destructive behavior, or persistence, but the allowed tool set is broader than needed. Prefer a version limited to Read and AskUserQuestion, or run it only where unintended file edits/searches and sub-agent delegation are contained.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:13
Finding

Overly Broad Tool Permissions Violate Least Privilege

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 13
Vulnerability Type: Excessive tool authorization
Risk Level: Medium

Vulnerable Code

yaml
allowed-tools: Read Edit Write Glob Grep Agent AskUserQuestion

Technical Analysis

The skill's documented workflow generates article hooks and titles, reads bundled reference files when needed, and asks the user to select an option. That workflow does not require filesystem mutation or sub-agent delegation.

Nevertheless, the configuration authorizes Edit, Write, and Agent. These capabilities permit the skill to alter files and delegate work beyond its stated copywriting purpose. Glob and Grep also permit broader workspace discovery than is necessary because all legitimate reference paths are known in advance.

Granting unnecessary capabilities expands the consequences of adversarial user content, future instruction changes, or unintended agent behavior. The finding is a least-privilege violation; the audited content does not itself direct the agent to misuse these tools.

Attack Path

  1. The agent loads the skill with all tools declared on line 13.
  2. A user supplies an article draft or other untrusted content containing adversarial instructions.
  3. The agent mistakenly treats that content as operational guidance rather than source material.
  4. Because the skill has unnecessary search, write, editing, or delegation permissions, the agent can discover unrelated files, modify workspace content, or delegate actions outside the copywriting workflow.
  5. The resulting access or modification occurs with the permissions of the hosting agent process.

This path depends on the host honoring allowed-tools as an authorization boundary and on an additional instruction-following failure. No active exploit instructions were found in the audited project.

Impact Assessment

Potential impact includes:

  • Discovery of unrelated workspace file names or contents through broad search t ...[truncated 416 chars]
Remediation
View remediation

Remediation Suggestions

Apply least privilege to the skill manifest:

yaml
allowed-tools: Read AskUserQuestion

Further hardening should include:

  1. Remove Edit, Write, and Agent, because the documented workflow does not require file mutation or delegation.
  2. Remove Glob and Grep unless a demonstrated workflow requires dynamic reference discovery.
  3. Restrict Read, where supported by the host, to SKILL.md and the bundled references/ directory.
  4. Treat article drafts and all user-provided text strictly as data, never as tool instructions.
  5. Add tests confirming that hook and title generation succeeds with only the reduced permission set.
  6. Add a manifest-review check that rejects newly introduced tools unless their necessity and permitted scope are documented.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill's trigger contract says it must not handle social posts, email subjects/openers, and similar excluded formats, but later title guidance explicitly defines behavior for those formats. In an agentic harness, this inconsistency can cause the skill to activate or provide instructions outside its declared scope, leading to policy bypass, incorrect routing, and unsafe downstream automation decisions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The documentation both forbids and instructs handling of unsupported contexts, creating ambiguous behavior at exactly the boundary where orchestration systems decide whether to invoke the skill. That ambiguity is dangerous because other skills or users can exploit the later instructions to elicit output for prohibited channels, undermining guardrails and causing accidental misuse rather than direct code execution.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The title explicitly frames the file as providing both English and French templates, and the body consistently includes French variants throughout. Because the document offers French outputs as a built-in behavior without stating that language should be selected based on user preference or opt-in, it can conflict with a policy requiring language choice rather than imposing a locale.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The document defines separate 'EN Formula Catalog' and 'FR Formula Catalog' sections, which encodes language-specific behavior in the skill reference. There is no natural-language instruction here that the user's preferred language should be requested or respected before using one locale-specific catalog versus the other.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.