ClawHub
Back to skill

Security audit

Sonic Consciousness Engineering

Security checks for vulnerabilities and agentic risk

Overview

This is a markdown-only music production skill with no code or system access, but users should treat its altered-state and brainwave claims cautiously.

Install only if you want creative music-production guidance around psychoacoustics and altered-state aesthetics. Do not treat the material as medical or therapeutic advice, avoid claims that tracks reliably manipulate brainwaves or nervous-system states, and use consent, moderate volume, breaks, and extra care for listeners with trauma, anxiety, dissociation, seizure risk, or other neurological or psychiatric vulnerabilities.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly frames music production as a way to 'alter consciousness' and references brainwave entrainment and altered states without any caution about possible adverse effects. Users may apply these techniques to vulnerable listeners, including those with anxiety, trauma, dissociation, or photosensitive/seizure-adjacent sensitivity to rhythmic stimulation, creating foreseeable psychological or physiological harm.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill provides operational guidance for binaural beats, isochronic tones, amplitude modulation, and rhythmic auditory stimulation while presenting them as mechanisms for altered states and autonomic effects. Because these techniques are described in a quasi-clinical way but without contraindications or safety boundaries, the content may encourage unsafe use or overstate efficacy, especially for users targeting relaxation, trance, or psychological change.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This section gives concrete guidance for inducing altered states, including deep trance, ego dissolution, and overlaps with psychedelic-like states, but provides no safety boundaries, contraindications, or warning context. In a skill explicitly aimed at consciousness engineering and immersive emotional manipulation, that omission increases the risk of unsafe use by vulnerable users or use in settings where informed consent is absent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Describing overwhelming stimulation and freeze responses as a 'powerful dramatic tool' normalizes using dysregulating stimuli to provoke involuntary stress responses without discussing consent, audience safety, or harm reduction. Because the skill is about psychologically shaping listener states, this can encourage creators to deliberately trigger distress reactions in listeners who may be unprepared or especially susceptible.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.