ClawHub
Back to skill

Security audit

Super Agent Skills

Security checks for vulnerabilities and agentic risk

Overview

This skill is a broad agent capability checklist that includes high-impact operations like network calls, scheduled jobs, containers, cloud services, databases, and deployment without enough scope or user-control guidance.

Review this skill carefully before installing. It is not visibly malicious, but it encourages an agent to use powerful local, network, cloud, scheduling, container, and deployment capabilities without clear approval gates or boundaries. Only use it in environments where you can enforce your own confirmations, restrict secrets and production access, and review commands before they run.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (6)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The skill broadly instructs agents to perform file operations, HTTP requests, scheduled tasks, code execution, container orchestration, cloud actions, and CI/CD without requiring user confirmation, scope limitation, or safety guardrails. In an agent skill, this omission is dangerous because it normalizes high-impact operations that could lead to unauthorized changes, data exfiltration, persistence, or destructive deployment activity if followed autonomously.

Content

No source excerpt is available for this finding.

File System Enumeration

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md
### 1. File Operations
- **Tools**: File Manager, File Reader, File Writer
- **Check**: `ls -la ~/skills/`

### 2. HTTP Requests
- **Tools**: curl, wget, httpie

External Transmission

Medium
Category
Data Exfiltration
Confidence
87% confidence
Finding

The skill explicitly demonstrates outbound HTTP requests and POSTing JSON to external endpoints. In the context of an autonomous agent capability library, network transmission examples are security-relevant because they can enable data exfiltration, contact with untrusted services, or unauthorized API interaction if the agent applies them without approval.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

2. HTTP Requests

  • Tools: curl, wget, httpie
  • Check: which curl && curl --version
  • Usage:
bash
curl -sS "https://api.example.com/data"

External Transmission

Medium
Category
Data Exfiltration
Confidence
79% confidence
Finding

The direct reference to an HTTPS API endpoint reinforces that the skill supports external communications. Although the endpoint is an example domain, the documented behavior still increases risk in an agent context because it encourages sending data off-host without accompanying restrictions or approval checks.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

  • Check: which curl && curl --version
  • Usage:
bash
curl -sS "https://api.example.com/data"
curl -X POST -H "Content-Type: application/json" -d '{"key":"value"}' URL

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
62% confidence
Finding

The title presents the skill in both English and Chinese, which may imply a fixed language/locale presentation rather than an explicit user-selected preference. Because the file does not explain language options or locale constraints, this could conflict with a policy requiring user opt-in for language or locale behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.