ClawHub
Back to skill

Security audit

Content Calendar

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent content-calendar planning guide with no executable code, hidden behavior, credential use, or persistence.

Before installing, expect the skill to use your brand, strategy, and content-pillar notes if present, and to recommend hand-offs to other planning, writing, trend, and scheduling skills. Review those hand-offs separately if they can publish or schedule real posts.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Context Window Stuffing

Medium
Category
Memory Poisoning
Confidence
85% confidence
Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · references/operating-rhythm.md (reported line 35)May include surrounding context.

md
- Keep at least a few days — ideally a week+ — of content queued in WoopSocial.
- The buffer absorbs bad weeks: when life happens, the queue keeps posting and the streak holds.
- Refill the buffer during the weekly ritual before it runs dry.

A buffer turns "consistency" from a willpower problem into a system property.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

This JSON eval file is in scope for vague-trigger checks, and the sample input uses the phrase "Help me build a content calendar...". The leading trigger wording overlaps with common everyday speech ("Help me"), without any explicit constraint or negative examples indicating when the skill should or should not activate.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.