ClawHub
Back to skill

Security audit

Cowhorse Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent workflow/skill builder, but it needs review because it can create persistent agent skills/scripts and store user workflow feedback in memory without clear limits or consent.

Install only if you intend to use this as a reusable skill-building assistant. Before letting it build or package a skill, review the generated SKILL.md and any scripts, keep generated files in a scoped workspace, and avoid storing raw feedback, credentials, private paths, schemas, or business details in MEMORY.md or memory logs unless you explicitly want that persistence.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T02 · Agent Memory Poisoning

Warning
Location
SKILL.md:165
Finding

Unnecessary Persistence of User-Controlled Workflow Data in Agent Memory

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:165-168
Additional Location: references/workflow_guide.md:161-166
Vulnerability Type: Persistent agent-memory poisoning
Risk Level: Medium

Vulnerable Code Snippets

From SKILL.md:

markdown
### Step 5: Finalize (完成)

1. **Package the skill** using `scripts/package_skill.py` from skill-creator
2. **Update MEMORY.md** with the new skill info
3. **Notify user** - Skill is ready for use

From references/workflow_guide.md:

markdown
## Iteration Pattern

**每次用户反馈后:**

1. 记录反馈内容到 memory/2026-03-15.md
2. 修改代码/文档
3. 重新呈现结果
4. 等待确认

Technical Analysis

The skill instructs the agent to write newly generated skill information and user feedback into persistent memory files. Workflow discovery can collect user-controlled content such as file paths, data schemas, business rules, operational instructions, and generated skill behavior.

The instructions impose no restrictions on which fields may be stored, do not require user consent, and provide no validation or sanitization before persistence. Because the persisted content may be loaded in later sessions, an attacker can provide workflow descriptions or feedback containing crafted instructions that become durable agent state.

Persistent memory updates are not required for the skill's stated core functions of discovering requirements, generating a skill, testing it, and packaging it.

Attack Path

  1. An attacker invokes the workflow-building skill.
  2. During discovery or feedback, the attacker supplies crafted workflow content containing instructions intended to influence subsequent agent behavior.
  3. The skill follows its documented finalization or iteration process and records the new skill information or feedback in MEMORY.md or a file under memory/.
  4. A later agent session loads or consults that persistent memory.
  5. The attacker-controlled content can then influence later decisions or behavior beyond the original ...[truncated 716 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the automatic instruction to update MEMORY.md or files under memory/.
  2. Store workflow-specific metadata within the generated skill's own directory rather than in global agent memory.
  3. If persistence is genuinely needed, require explicit and informed user consent before every write.
  4. Apply strict data minimization: retain only a short identifier and non-sensitive status metadata.
  5. Reject or neutralize executable instructions, role directives, tool commands, and prompt-like content before persistence.
  6. Define retention and deletion controls so users can inspect and remove stored information.
  7. Keep sensitive paths, credentials, business data, schemas, and raw feedback out of long-term memory.
  8. Ensure later sessions treat persisted text as untrusted data rather than authoritative instructions.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Self-Modification

High
Category
Rogue Agent
Confidence
95% confidence
Finding

The skill instructs the agent to create directories, write SKILL.md, add scripts, package the skill, and update MEMORY.md, which is self-modifying behavior affecting the agent's own capability set and persistent state. If triggered by untrusted user input, this enables an attacker to influence future behavior, plant unsafe automation, or create persistence through generated skills and memory updates.

Content

Scanner excerpt · SKILL.md (reported line 130)May include surrounding context.

md
Once confirmed, build the skill:

1. **Create skill directory** using `scripts/init_skill.py` from skill-creator
2. **Write SKILL.md** with:
   - Frontmatter: name, description (triggers + when to use)
   - Body: Complete workflow instructions, all steps, decision trees
3. **Add scripts** if automation is needed:

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The documented trigger phrases are broad, generic requests such as '建一个 skill' and '帮我做一个工具' that can easily overlap with ordinary user intents. In an agent environment, this can cause unintended activation of the skill, leading the model to shift into a workflow-building mode when the user did not explicitly request it, which can confuse execution flow, collect unnecessary information, or interfere with higher-priority task handling.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill advertises very broad trigger phrases such as helping users build a workflow, tool, or skill, which overlap with many ordinary requests. This can cause the skill to activate in contexts where it is not the best-scoped handler, increasing the chance it steers conversations into creating automation or code for tasks the user did not explicitly ask to formalize.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The activation rule 'When user describes a task they want AI to support' is highly ambiguous and effectively matches a large portion of normal assistant interactions. Over-broad activation can lead to unintended takeover of sessions, unnecessary elicitation of sensitive operational details, and escalation from simple advice into tool-building or automation workflows.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This markdown file contains substantial Chinese-language workflow content and example user interactions alongside English headings, but it does not state that the skill is intended specifically for Chinese-speaking users or provide any opt-in language selection. Under the policy rule, forcing or assuming a specific language/locale without user choice is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The guide explicitly instructs recording user feedback into a persistent memory log even though the skill’s stated purpose is workflow requirement extraction, not long-term user data retention. That creates unnecessary data collection and retention risk, especially if feedback contains file paths, business details, or other sensitive context gathered during discovery.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script's user-facing prompts and instructions are entirely in Chinese, including directives for how the workflow discussion must be conducted. Because the file provides no opt-in, language selection, or justification that the skill is intended only for a Chinese-speaking context, this is a natural-language policy concern under the locale-choice rule.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
73% confidence
Finding

The build summary states references/: 无 (简单项目), implying no reference materials existed for the example skill. However, this file presents itself as a workflow reference containing that very example, creating a direct documentation-level inconsistency about whether reference material was part of the delivered structure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.