ClawHub
Back to skill

Security audit

Intelligence Ingestion

Security checks for vulnerabilities and agentic risk

Overview

The skill is transparent about its goal, but it automatically stores and turns untrusted web or chat content into persistent memory and draft skills, so it needs review before installation.

Install only if you want this skill to make persistent local knowledge-base and agent-memory changes from external content. Use a test vault first, review generated files under skills/_drafts before moving them into active skills, and avoid feeding it untrusted URLs unless you are prepared to inspect the resulting notes, memory entries, and landscape changes.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:119
Finding

Untrusted Remote Content Can Hijack the Ingestion Workflow and Generated Skill Instructions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 119-145 and 213-257
Vulnerability Type: Prompt injection through untrusted content ingestion and instruction synthesis
Risk Level: High

Vulnerable Code Snippets

markdown
## The 8-Step Pipeline

### Step 1: READ — Extract Content
Execute extraction according to the Strategy chain. Log the successful extraction method.

### Step 2: CLASSIFY — Categorize
Assign **1 primary category** + up to 2 tags:
markdown
### Step 6: SYNTHESIZE — Auto-Skill Generation (Evolution Step)

**Trigger:** Content describes an **actionable tool, API, protocol, or technique** that the Agent currently lacks.

**Do NOT trigger if:** Content is purely theoretical, an opinion piece, a capability the Agent already possesses, or ranked ⚪ Low purely regarding strategic value.

**Execution:**

1. **Gap Analysis:** Compare current `skills/` directory and Strategic Landscape to confirm this is a missing capability.
2. **Draft Minting:** Create a new Skill folder in `{workspace}/skills/_drafts/`:

skills/_drafts/[skill-name]/
├── SKILL.md          # Generated behavior definition
└── README.md         # Brief description, source, dependencies

3. **SKILL.md Template:**

## Execution Flow
[Step-by-step logic pulled from ingested docs]

Technical Analysis

The Skill directs the Agent to fetch and interpret arbitrary user-provided URLs and subsequently derive Agent execution instructions from the ingested documents. It does not establish a security boundary between trusted Skill instructions and untrusted document content.

No instructions require the Agent to:

  • Treat fetched text exclusively as inert data.
  • Ignore commands, role changes, tool requests, or policy statements embedded in a source.
  • Detect or quarantine prompt-injection patterns.
  • Restrict generated execution steps to independently verified documentation.
  • Require confirmation before producing a Skill draft based on remote instructions.

...[truncated 2144 chars]

Remediation
View remediation

Remediation Suggestions

  1. Add an explicit instruction that all fetched or pasted content is untrusted data and that commands found within it must never be followed.
  2. Separate content acquisition from Agent reasoning. Extract plain text in a constrained stage before supplying it to the analytical pipeline.
  3. Detect and quarantine prompt-like directives, including requests to change roles, reveal secrets, invoke tools, modify files, or ignore prior instructions.
  4. Generate execution flows only from independently verified, allowlisted documentation sections rather than copying steps directly from source content.
  5. Require explicit operator confirmation before creating any Skill draft.
  6. Include source provenance and exact quotations for every generated execution step so reviewers can trace its origin.
  7. Add a mandatory security review section to generated drafts covering requested tools, network access, filesystem access, credentials, and shell commands.
  8. Keep draft directories technically excluded from runtime discovery and verify this isolation in host configuration rather than relying only on documentation.
  9. Refuse synthesis when a source contains obfuscated content, conflicting instructions, unverifiable dependencies, or requests for elevated privileges.

T02 · Agent Memory Poisoning

Error
Location
SKILL.md:259
Finding

Attacker-Influenced Analysis Is Mandatorily Written to Persistent Agent Memory

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 259-266
Vulnerability Type: Persistent memory poisoning through untrusted ingestion results
Risk Level: High

Vulnerable Code Snippet

markdown
### Step 7: REMEMBER — Update Core Memory

1. **Mandatory:** Append to daily log `{workspace}/memory/YYYY-MM-DD.md`
2. **If 🔴 Critical:** Sync update to `{landscape_path}`
3. **If Tool related:** Flag `TOOLS.md` for review
4. **If Skill Draft Synthesized:** Log the draft path and flag it as entirely pending human review.

Technical Analysis

The Skill mandates that every ingestion append information to the Agent’s daily memory. Content classified as critical is also synchronized to the Strategic Landscape. Because earlier pipeline stages process arbitrary remote content without prompt-injection isolation, attacker-influenced conclusions can cross from an untrusted source into trusted, persistent Agent state.

The design does not require:

  • Operator approval before memory writes.
  • Separation of source quotations from trusted conclusions.
  • A trust or confidence score for persisted information.
  • Sanitization of imperative instructions.
  • Expiration, rollback, or quarantine of unverified memory entries.
  • Provenance enforcement when later sessions consume the stored state.

Consequently, malicious content can continue influencing future sessions after the original ingestion has ended. The persistence mechanism is a legitimate feature rather than a hidden backdoor, but its mandatory use with insufficiently validated input creates a memory-poisoning vulnerability.

Attack Path

  1. An attacker creates content containing false strategic claims or embedded Agent directives.
  2. A user submits the attacker-controlled URL or text for analysis.
  3. The untrusted content influences the Agent’s assessment or is classified as strategically important.
  4. Step 7 mandates appending the resulting information to {workspace}/memory/YYYY-MM-DD.md. 5 ...[truncated 911 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove mandatory automatic memory writes for content derived from untrusted sources.
  2. Require explicit operator approval before promoting an ingestion result into persistent memory or the Strategic Landscape.
  3. Store unverified ingestion results in a separate quarantine area that is not automatically loaded as trusted Agent context.
  4. Persist source provenance, retrieval time, extraction method, trust level, and exact supporting quotations with every entry.
  5. Strip or clearly delimit imperative language so stored source material cannot be interpreted as future Agent instructions.
  6. Introduce trust states such as unverified, reviewed, and approved; only approved entries should influence future Agent behavior.
  7. Add rollback and deletion mechanisms that can remove all memory, landscape updates, and drafts associated with a source URL.
  8. Prevent source content from directly modifying identity files, system prompts, tool policies, or other high-trust memory.
  9. Revalidate critical classifications through an independent review step before updating the Strategic Landscape.
  10. Log every persistent write and present a diff to the operator before committing it.

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Vague Triggers

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The trigger conditions include very common phrases such as "analyze this" and "what do you think about this," which can cause the skill to activate in many routine conversations. Because this skill performs network access, reads existing skills, and writes multiple local files, accidental invocation increases the chance of unintended data ingestion, persistence of untrusted content, and unexpected side effects.

Content

No source excerpt is available for this finding.

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Although the text claims "No Self-Modifying Agents," the skill still generates new skill artifacts under skills/_drafts/ based on untrusted external content and existing local skills. That is a form of code/capability synthesis, and even with manual review, it creates a pathway for prompt-injected or malicious source material to influence future agent behavior, especially if operators later approve drafts without deep inspection.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

md
This Skill embraces a trust-first design philosophy:

1. **No Self-Modifying Agents.** Auto-generated Skills are isolated as drafts. You, the human operator, must review and approve them before they activate.
2. **Skills are the new Config.** No need to modify configuration files or monster if-else scripts. A single Skill file defines a capability.
3. **Build. For. Agents.** Built with an MCP manifest, structured outputs, and CLI installation so that any Agent in the ecosystem can find, understand, and use it.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The auto-trigger rules remain ambiguous because they activate on broad behaviors like pasted blocks and forwarded content from any chat interface. In this skill's context, ambiguous triggering is more dangerous because execution can lead to external fetches, storage in Obsidian, memory updates, landscape changes, and draft skill generation from untrusted content.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The auto-trigger phrase 'analyze this' is overly generic and is likely to match ordinary user requests that were not intended to invoke a high-privilege ingestion workflow. In this skill, invocation can lead to network fetches, filesystem writes, strategic landscape updates, memory logging, and draft skill generation, so accidental activation materially expands side effects beyond what a user may expect.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.