ClawHub
Back to skill

Security audit

Skill Inventory Expert

Security checks for vulnerabilities and agentic risk

Overview

The skill is a straightforward skill-inventory guide, but it should be used carefully because it asks agents to inspect local skill directories and a Claude skills configuration file.

Install only if you want an agent to inventory its local skills. Before using it, review any generated inventory before sharing it, avoid dumping full SKILL.md contents, and do not read ~/.claude/skills.json unless you are comfortable exposing local skill configuration metadata.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

other

Note
Location
SKILL.md:48
Finding

Unrestricted Environment and Agent Configuration Reconnaissance

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 48-78
Vulnerability Type: Environment reconnaissance and sensitive configuration access
Risk Level: Low

Evidence

bash
### Method 1: Directory Scan
# List all skill directories
ls -la ~/skills/

# Find all SKILL.md files
find ~/skills -name "SKILL.md"

# Count skills
find ~/skills -name "SKILL.md" | wc -l

### Method 2: Config File
# Read skill configuration
cat ~/.claude/skills.json

# Read a specific skill
cat ~/skills/{skill-name}/SKILL.md

### Method 3: Runtime Detection
# Check available tools
which python3 && python3 --version
which node && node --version
which docker && docker --version
which curl && curl --version

Technical Analysis

The skill instructs the agent to perform systematic local reconnaissance by enumerating installed skills, reading an agent-specific configuration file, inspecting other skill instructions, and fingerprinting available execution and networking tools.

Although these commands are consistent with the stated inventory purpose and do not bypass operating-system permissions, the guidance does not define directory boundaries, require user authorization, or require redaction before inventory results are reported. In particular, ~/.claude/skills.json may contain configuration details beyond the minimum information required to list installed skills. Reading every discovered SKILL.md file can also reveal operational instructions, internal paths, or capability details.

No evidence of data transmission, privilege escalation, persistence, remote payload retrieval, destructive behavior, or malicious code execution was found. Consequently, this is classified as a low-risk reconnaissance and excessive-access concern rather than one of the listed T01-T09 attack classes.

Attack Path

  1. The skill is loaded and its discovery guidance is followed.
  2. The age ...[truncated 1028 chars]
Remediation
View remediation

Remediation Suggestions

  1. Require explicit user approval before scanning skill directories, configuration files, or runtime installations.
  2. Restrict discovery to a user-approved skills root and reject paths that resolve outside that boundary.
  3. Do not read ~/.claude/skills.json by default. Prefer a dedicated inventory interface or a sanitized metadata file containing only names, versions, descriptions, and approved paths.
  4. If configuration access is necessary, parse only an allowlisted set of fields and redact credentials, tokens, endpoints, personal data, and sensitive filesystem paths.
  5. Inspect other SKILL.md files only when needed and avoid reproducing their full contents in inventory output.
  6. Make runtime fingerprinting opt-in and omit exact versions unless they are necessary for the requested assessment.
  7. Present the collected inventory to the user for review before transmitting or returning it to another party.
  8. Document the scan scope, accessed files, excluded sensitive fields, and data-retention behavior.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (8)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

md
find ~/skills -name "SKILL.md"

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

md
find ~/skills -name "SKILL.md"

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
95% confidence
Finding

The instruction to read ~/.claude/skills.json targets an agent configuration directory in the user's home folder. Accessing config files can reveal private environment details, installed capabilities, file paths, tokens, or other sensitive metadata, especially if agents follow the guide automatically.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

Method 2: Config File

bash
# Read skill configuration
cat ~/.claude/skills.json

# Read a specific skill
cat ~/skills/{skill-name}/SKILL.md

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md
{
      "name": "Skill Name",
      "slug": "skill-slug",
      "path": "skills/xxx/SKILL.md",
      "source": "local",
      "version": "1.0.0",
      "description": "What this skill does"

File System Enumeration

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The skill instructs enumerating directories under ~/skills and locating all SKILL.md files, which reveals local filesystem structure and the set of installed capabilities. In an agent setting, capability inventory can materially aid follow-on abuse by identifying available tools, execution surfaces, and data access functions.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

Method 1: Directory Scan

bash
# List all skill directories
ls -la ~/skills/

# Find all SKILL.md files
find ~/skills -name "SKILL.md"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

which python3 && python3 --version which node && node --version which docker && docker --version which curl && curl --version

text

---

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
73% confidence
Finding

The title and introductory description are presented bilingually with Chinese first, but the document does not state that language selection is optional or user-configurable. This can be interpreted as imposing a locale preference without explicit user opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill explicitly instructs reading local configuration and installed skill files from user-specific paths without any warning, minimization, or consent boundary. In an agent context, this can disclose sensitive local metadata such as installed capabilities, filesystem layout, and potentially configuration details that should not be automatically exposed or reported.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.