ClawTrace Runtime Observatory

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:50 AM UTC
• Version: 1.0.1

Overview

This is a coherent runtime debugging skill, but it can expose broad internal workflow context through vague or automatic triggers.

Install only in environments where users are allowed to inspect runtime traces and previous outputs. Prefer explicit diagnostic commands, trusted debug-mode metadata, and redaction of secrets or private context before exposing trace output.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: The activation triggers include very broad everyday terms such as "debug" and "trace", which can cause the skill to activate unintentionally during ordinary user conversations. Because this skill is designed to inspect full runtime logs, prior outputs, and context data, accidental activation could expose sensitive internal state or workflow information to users who did not explicitly request privileged debugging access.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

---
name: clawtrace-runtime-observatory
description: AI Runtime Observatory（AI运行时观测系统）— 观察、重建、记录、解释 AI Workflow 在运行时真正做了什么。触发场景：(1) 用户输入 "debug"、"启动debug模式"、"进入debug"、"trace"、"查看workflow"、"查看运行过程"、"查看skill调用"、"runtime trace"；(2) meta.debug_mode = true；(3) 系统自动触发（retry_count 大于等于1、fallback被触发、Critic与Executor严重冲突、Context Integrity失败、data_envelope缺失、nested_skill_detected = true、workflow_integrity = degraded）。只观察、只记录、只解释。绝对禁止修改任何Workflow、data_envelope、previous_output、Skill输出。禁止自动修复、自动执行fallback、自动触发retry、替代Orchestrator决策、伪造日志、猜测不存在的Workflow。
---

# ClawTrace Runtime Observatory

• Confidence: 88% confidence
• Finding: The skill treats `meta.debug_mode = true` and multiple automatic system conditions as sufficient to enter debug mode, creating an unsafe default path into a high-visibility observability state. If upstream components set this flag too broadly or an attacker can influence metadata or error conditions, the skill may expose internal execution data without a deliberate, user-authorized debugging request.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The user-trigger activation list relies on ambiguous phrases without clear scope boundaries, so normal requests like asking to "view workflow" or "trace" something could invoke the observability mode. In this skill's context, that is risky because activation grants broad access to internal execution details, nested skill structure, and prior outputs that may contain sensitive or privileged information.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

输入：
```
meta.debug_mode = true
```

则启动。

• Confidence: 89% confidence
• Finding: The explicit rule that `meta.debug_mode = true` automatically starts the observability workflow creates a privileged behavior toggle controlled by metadata rather than by strong access control. In a multi-agent or nested-skill environment, this can be abused or misconfigured to reveal internal traces, prior outputs, and context data beyond what the user should see.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill mandates reading `context.trace_logs`, `context.previous_output`, and `context.data_envelope`, but it does not provide a user-facing warning that these sources may contain sensitive data. This lack of disclosure increases the risk of over-collection and inadvertent disclosure of secrets, personal data, or internal reasoning artifacts during debug output.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly instructs broad collection and exposure of runtime context, previous outputs, and full trace logs in a natural-language debug mode. Even though it says it is observational only, the data exposure risk is significant: internal chain-of-thought-like artifacts, system metadata, credentials in logs, or user-sensitive context could be surfaced through reconstruction and explanation features.

Static analysis

No suspicious patterns detected.