ClawHub
Back to skill

Security audit

ceo-todo

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed to-do workflow that edits a user-chosen markdown file and optionally reads Gmail/Slack through read-only connectors to capture commitments.

Before installing, understand that the manual skill will modify the markdown to-do file you point it at and create backups beside it. Only use the daily agent if you are comfortable granting read-only Gmail and Slack connector access for commitment capture.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Hidden Instructions

High
Category
Prompt Injection
Content
## Fixture cases (for the behavioral + reliability check)

<!--
These four lines exercise the state-transition rules. Given today = 2026-07-06,
a correct run of the skill should produce the transitions noted in each comment.
The doc as written below is the PRE-run state and is itself grammar-valid
Confidence
21% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
-->

- [STALE] [#f601] P1 · Finalize the FY27 hiring plan with Priya · updated: 2026-06-27
  <!-- FIXTURE (a): 9 days old (2026-06-27 → 2026-07-06). P1 and > 7 days ⇒ the
       last run correctly re-tagged this OPEN → [STALE]. This is the post-run
       state; see references/evals/good-clean.md for the same transition asserted
       as a golden. (Parked items are exempt from staleness — see fixture (d).) -->
Confidence
21% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
as a golden. (Parked items are exempt from staleness — see fixture (d).) -->

- [OPEN] [#f702] P2 · Review the security questionnaire from BigCo · updated: 2026-06-30
  <!-- FIXTURE (b): 6 days old (2026-06-30 → 2026-07-06). NOT > 7 days ⇒ a
       correct run leaves this OPEN. Boundary guard: it must NOT be marked STALE. -->

- [WAITING] [#f803] P1 [reply-by: 2026-07-02] · CFO to send the updated cash model · updated: 2026-06-25
Confidence
21% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Static analysis

No suspicious patterns detected.