ClawHub
Back to skill

Security audit

Universal Data Model for the next generation of AI-driven smart spaces

Security checks for vulnerabilities and agentic risk

Overview

This skill appears benign because it only generates a local JSON smart-space data model, but real device or sensor integrations should remain explicitly user-controlled.

Installers should understand that this creates a local schema template, not a device controller. Before giving the generated model to agents connected to smart-home systems, enforce explicit user permissions, sensor privacy limits, and review overwrite behavior for s2_primitive_data/primitive_6_elements_template.json.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

The skill frames AI agents as the default operators of physical space rather than an explicitly user-authorized tool, which can normalize autonomous environmental control without clear consent boundaries. In the context of smart-space orchestration, this increases the risk of overbroad agent authority, unexpected actuation, or privacy-impacting automation if downstream systems treat the model as permission to control devices.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The file embeds bilingual Chinese/English text in comments, docstrings, metadata, and console output as the only presented locale. This imposes a specific language/locale convention on users without any option to select a preferred language, which matches the policy's language-choice concern.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill declares that no camera recording is permitted, but the schema still includes unrestricted visual and video-stream fields that can describe playback or display sources without any technical guardrail enforcing the privacy claim. This creates a misleading privacy assurance and could cause downstream agents or users to trust the model as camera-safe when nothing in code prevents later extension or misuse of those fields for surveillance-adjacent content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The markdown explicitly instructs the user to run a script that will generate primitive_6_elements_template.json locally, which is a file write operation. While this behavior is stated, there is no user warning or caution about modifying the local directory or overwriting an existing file, which is the kind of data-affecting behavior this rule covers for markdown descriptions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.