ClawHub
Back to skill

Security audit

Todo Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is a simple planning and to-do helper with broad wording, but the inspected artifacts do not show hidden access, persistence, exfiltration, or destructive behavior.

Installers should treat this as a lightweight planning aid, not a robust autonomous execution system. Before using it for tasks that change files, accounts, finances, public content, or external services, require clear user confirmation for each impactful step.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The declared description promises a planning/orchestration capability: breaking large tasks into smaller steps, optimizing execution, and adapting dynamically as progress changes. The supplied code does not implement any of those behaviors. Instead, it provides basic task storage and management operations (add, list, update, clear) for a flat to-do list. While updating task status is loosely related to tracking progress, there is no logic for decomposition, optimization, or adaptive replanning. Therefore, the actual behavior materially differs from the declared purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The workflow explicitly says to "Execute tasks one by one" but provides no safety guardrails, consent checks, or warnings about actions that could affect user data, accounts, files, systems, or external services. In an agentic environment, this can normalize autonomous action on ambiguous requests and lead to harmful or unauthorized operations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The trigger phrase "Plan and execute [TASK] step by step" is broad enough to match ordinary user requests, which can cause unintended invocation of the skill in situations the user did not explicitly scope. Because the skill frames itself as executing tasks, overbroad activation increases the chance of the assistant taking or proposing impactful actions without clear user intent boundaries.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.