ClawHub
Back to skill

Security audit

Cross-Channel & Cross-Agent Skill Sharing

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed workflow for recording and sharing newly added workspace capabilities, with persistence that users should review but no evidence of hidden or destructive behavior.

Install this only if you want agents to keep workspace capability notes and share them across sessions. Review any generated SKILL.md, scripts, TOOLS.md, or memory changes before relying on them in future work.

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Session Persistence

Medium
Category
Rogue Agent
Content
- Package versions
   - One-line usage note

3. Create or update a reusable skill when pattern is repeatable:
   - Add/adjust `SKILL.md`
   - Add scripts under `scripts/` for deterministic steps
   - Keep instructions concise and invocation-focused
Confidence
86% confidence
Finding
This skill explicitly instructs the agent to create or update reusable skills and scripts, which introduces session-to-session persistence. In a trusted workspace this can be useful, but from a security perspective it creates a propagation path where accidental or adversarial instructions can be codified into future agent behavior and spread across channels/agents.

Static analysis

No suspicious patterns detected.