T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:17- Finding
Mutable Remote Instructions and Results Are Treated as Trusted Agent Context
- Content
View full analysis
- Remediation
View remediation
Security audit
ClawHarbor
Security checks for vulnerabilities and agentic risk
Overview
This skill is purpose-aligned but needs review because it sends broad user task descriptions to an external human-operated service and presents externally supplied payment links without clear safeguards.
Review this skill before installing if you may delegate confidential, personal, regulated, credential-adjacent, or business-sensitive work. Only submit task descriptions you are comfortable sending to ClawHarbor and human agents, inspect payment links carefully before opening them, and treat returned results as untrusted external content.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:45- Finding
Externally Supplied Payment URL Is Presented Without Destination Validation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README encourages agents to submit arbitrary user-defined tasks to an external service and retrieve results, but it does not warn that prompts, files, or other task data may leave the local trust boundary and be visible to a third party. In an agent skill context, that omission is security-relevant because users may delegate sensitive business, personal, credential-adjacent, or regulated information without understanding the privacy and data-handling risks.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README states that 'Anything you can describe in natural language' can be delegated, which normalizes extremely broad third-party tasking without any guardrails for sensitive, high-impact, or unsafe requests. In this skill's context, that broad scope increases the chance that users or upstream agents will transmit confidential data or outsource decisions/actions that should remain under tighter human review.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
This skill directs the agent to send task descriptions to an external domain, which is a real data exfiltration surface even if it is the intended functionality. The danger is amplified because the transmitted content can be arbitrary natural-language user input, potentially including sensitive information or embedded internal context.
- Content
Read the full API documentation:
text curl https://clawharbor.app/v1Submit a task:
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill explicitly advertises delegation of 'any task describable in natural language,' which creates an overly broad capability boundary for sending user requests to an external third party. In practice, this increases the chance that sensitive data, regulated content, or unsafe instructions will be forwarded off-platform without adequate scoping or review.
- Content
Unbounded Output
Medium
- Category
- Output Handling
- Confidence
- 60% confidence
- Finding
Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.
- Content
md ## Important Notes - The payment_url contains a # fragment that is essential. Always present the COMPLETE URL to the user without truncation. - Send payment links as clickable links or plain text — do NOT use code blocks or monospace formatting. - If status becomes "rejected", no agents are available. The user should try again later. - Results are delivered as plain text in the result field.
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill states that task descriptions are sent to ClawHarbor servers and processed by human agents, but it does not clearly warn users not to include sensitive or confidential information. Because the service involves third-party and human access, omission of that warning materially raises the risk of privacy breaches, data leakage, and unauthorized disclosure.
- Content