ClawHub
Back to skill

Security audit

Peer Review

Security checks for vulnerabilities and agentic risk

Overview

The skill is not malware, but it asks agents to post and log high-stakes review content to Discord without clear consent or redaction controls.

Install only if you are comfortable with review inputs and outputs potentially being shared in the named Discord channels. Keep confidential, personal, credential, customer, financial, or unpublished business content out of this workflow unless Discord posting/logging is disabled or an explicit approval and redaction process is added.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

other

Warning
Location
SKILL.md:112
Finding

Potential Sensitive Data Exposure Through Unconditional Discord Posting and Logging

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:112-116 and SKILL.md:154-158
Vulnerability Type: other: Sensitive Data Exposure
Risk Level: Medium

Vulnerable Content

markdown
## Discord Workflow

1. Post analysis to **#the-deep** (or #swarm-lab)
2. Drift, Pip, and Lume respond with independent critiques
3. Celeste synthesizes: deduplicates flags, weights by model confidence
4. If consensus (≥2 models agree) → flag is high-confidence
5. Final output posted with recommendation: `publish` | `revise` | `flag_for_human`
markdown
## Integration

When peer review passes validation:
- Package as Reef API endpoint: `POST /review`
- Agents call before publishing any analysis
- Configurable: model selection, consensus threshold, categories
- Log all reviews to `#reef-logs` with TPR tracking

Technical Analysis

The skill is presented as a local peer-review layer using Ollama, but its documented workflow instructs users or integrating agents to post analyses and final review results to Discord channels and to log all reviews in #reef-logs.

The instructions do not require:

  • Explicit user authorization before external disclosure.
  • Classification or redaction of sensitive input.
  • Channel or server allowlisting.
  • Verification of channel membership and access controls.
  • Data minimization.
  • A retention or deletion policy.
  • Suppression of secrets, personal data, or confidential business information.

Analyses selected for this skill are explicitly described as potentially high-stakes. Such content may contain unpublished research, financial information, customer data, personal information, credentials, internal decisions, or other confidential material. Sending it to Discord changes the trust boundary from local processing to a third-party service and potentially exposes it to every account, integration, bot, and retention mechanism with access to th ...[truncated 1644 chars]

Remediation
View remediation

Remediation Suggestions

  1. Keep peer-review inputs and outputs local by default. Treat Discord publication as a separate, explicitly enabled feature.
  2. Require informed user confirmation before transmitting any original text, critique, or final result to an external service.
  3. Add mandatory secret and sensitive-data detection covering credentials, personal data, financial data, customer information, proprietary content, and internal identifiers.
  4. Redact or summarize sensitive content before posting. Do not send the complete source analysis unless expressly authorized.
  5. Allowlist approved Discord servers and channels rather than accepting arbitrary destinations.
  6. Require least-privilege bot permissions and verify channel access controls before every publication.
  7. Define retention, deletion, audit, and incident-response policies for review logs.
  8. Provide configuration controls to disable source-text posting and centralized review logging independently.
  9. Record consent and disclosure metadata without duplicating sensitive review content.
  10. Clearly document that Discord is a third-party trust boundary and that local-model processing does not make the overall workflow local when external posting is enabled.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.