ClawHub
Back to skill

Security audit

Aidlc

Security checks for vulnerabilities and agentic risk

Overview

This development workflow is mostly coherent, but it persistently records all user input verbatim and broadly scans project files without enough up-front control or redaction.

Review before installing. Use this skill only in workspaces where you are comfortable with broad project inspection and repository file creation. Do not paste secrets, credentials, private keys, tokens, personal data, or confidential snippets unless the audit behavior is changed or you explicitly accept that they may be stored in aidlc-docs/audit.md. Consider requiring explicit opt-in, redaction, and an ignored or deletable audit log before use.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
references/inception/reverse-engineering.md:311
Finding

Persistent Storage of Unredacted User Input

Content
View full analysis

Vulnerability Details

File Location: references/inception/reverse-engineering.md:311
Vulnerability Type: Unredacted sensitive-data logging
Risk Level: Medium

Complete Vulnerable Snippet:

markdown
- **MANDATORY**: Log user's response in audit.md with complete raw input

The same behavior is imposed globally by SKILL.md:72, which requires every user input to be recorded verbatim in aidlc-docs/audit.md, and by SKILL.md:219, which requires that audit file to be append-only.

Technical Analysis

The Skill persistently records complete user responses without requiring redaction, sensitivity classification, informed consent, access controls, or a retention policy. Software-development conversations can contain API keys, passwords, authentication tokens, proprietary source code, personally identifiable information, internal infrastructure details, and incident data.

This behavior conflicts with the Skill's own security baseline at references/extensions/security/baseline/security-baseline.md:76-82, which prohibits passwords, tokens, secrets, and personally identifiable information from appearing in logs. Because raw input is mandatory and the audit log is append-only, sensitive information cannot be safely omitted or corrected under the defined workflow.

No external transmission mechanism was identified. The vulnerability is therefore a local plaintext retention and accidental-disclosure risk rather than confirmed network exfiltration.

Attack Path

  1. A user includes a credential, token, personal record, proprietary code fragment, or other confidential information in a workflow response.
  2. The Skill follows its mandatory logging instruction and copies the complete response into aidlc-docs/audit.md.
  3. The sensitive content remains in the append-only audit file without redaction or expiration.
  4. The workspace is committed to version control, backed up, indexed, packaged, or shared with c ...[truncated 861 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace verbatim transcript logging with minimal event logging that records workflow stage, action, timestamp, and outcome only.
  2. Apply secret and personally identifiable information detection before every audit write. Redact passwords, tokens, API keys, authorization headers, private keys, session identifiers, and personal records.
  3. Require explicit user opt-in before retaining raw conversation content, with the default set to no raw retention.
  4. Allow users to inspect, correct, and delete audit entries rather than requiring permanently append-only storage.
  5. Define retention and automatic deletion periods appropriate to the project's sensitivity.
  6. Add aidlc-docs/audit.md to version-control ignore rules by default and warn users before repository commits or artifact packaging.
  7. Restrict audit-file permissions to the current user and avoid copying it into build outputs, deployment bundles, or shared documentation.
  8. Update every phase-specific logging instruction to enforce the bundled security baseline consistently.
  9. Add automated tests confirming that representative credentials and personal data are redacted before being written.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (17)

Vague Triggers

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The invocation conditions are extremely broad and match routine software-development requests such as starting a project, adding a feature, fixing a bug, or refactoring. That increases the chance the skill is auto-invoked in ordinary conversations, which can unexpectedly impose file-writing, workflow-control, and data-persistence behaviors on users who did not explicitly consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill mandates that all user input be recorded verbatim to an audit log, but the top-level description does not clearly warn users of that behavior before invocation. This creates a consent and privacy problem because users may disclose secrets, credentials, proprietary code, or personal data during normal development discussion without realizing it will be permanently written to disk.

Content

No source excerpt is available for this finding.

Ssd 3

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

Mandating verbatim logging of all user inputs to aidlc-docs/audit.md creates a direct natural-language data leakage channel. In this skill's context, users are likely to share bug details, stack traces, config values, internal architecture, API payloads, or even secrets, so automatic persistent logging materially increases exposure, retention risk, and downstream exfiltration risk through repository sync or later agent access.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
78% confidence
Finding

The file hardcodes 'Chinese triggers' and 'English triggers' as the activation language model for the skill, but does not state that users may choose their preferred language or that the skill is intentionally limited to those locales. This can be a natural-language policy issue because the skill behavior is tied to specific languages without explicit opt-in or justification.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/common/overconfidence-prevention.md (reported line 79)May include surrounding context.

md
## Quality Assurance

### Red Flags to Watch For
- Stages completing without asking any questions on complex projects
- Proceeding with vague or ambiguous user responses
- Skipping entire question categories without justification
- Making assumptions instead of asking for clarification

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The file imposes a rigid interaction constraint by forbidding questions in chat and requiring all questions to go through files, with no user opt-in, accessibility fallback, or exception path. In an agent workflow, this can override user-preferred communication channels, create denial-of-service-like friction, and steer the agent into filesystem-mediated interactions that may be unavailable, unsafe, or inappropriate for the environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill instructs the agent to automatically read broad categories of prior artifacts, including all code files and previous artifacts, before resuming work. In an agent setting this is a real privacy and least-privilege issue because it expands workspace access beyond what the user just requested, increasing the chance of collecting sensitive code, credentials, or unrelated proprietary material without explicit notice or consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The instruction to log the continuity prompt in audit.md creates a silent persistence channel for user interaction details without notifying the user or limiting what gets recorded. This can lead to unintended storage of sensitive project context, user decisions, or potentially secrets in workspace files that may later be committed, shared, or re-read by the agent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This skill explicitly instructs the agent to create and update multiple files across the user's workspace, including state and audit files, but does not require any user warning, confirmation, or scoping safeguards before writing. In an agent setting, silent file creation/modification can overwrite existing content, pollute repositories, or persist misleading records, especially because the workflow presents the phase as complete and mandates audit logging regardless of user awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill directs the agent to scan the entire workspace and generate or update many files, but it does not require explicit user notice or consent before reading potentially sensitive project contents or making broad documentation changes. In an agent context, this can cause unanticipated access to secrets, proprietary code, or unrelated packages and can also lead to unwanted file modifications across the repository.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The instruction to log the user's complete raw input to audit records creates a data retention risk because prompts may contain credentials, personal data, internal URLs, incident details, or other sensitive material. Persisting verbatim input increases exposure surface and can turn transient secrets into stored secrets that may later be accessed, leaked, or reused improperly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The workflow explicitly instructs the agent to log the user's COMPLETE RAW response into an audit file, but the skill metadata/description does not disclose this data retention behavior to the user. This creates a privacy risk because users may include secrets, credentials, internal URLs, personal data, or other sensitive project details in approval/change requests, which would then be persisted unnecessarily.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The specific instruction to record the user's complete raw response increases the chance of collecting and retaining sensitive information far beyond what is needed for auditability. In this skill context, users are likely to provide implementation details, environment information, tokens pasted by mistake, or proprietary requirements, making indiscriminate raw logging especially risky.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill explicitly instructs the agent to create aidlc-docs/aidlc-state.md as part of automatic workflow execution, and later states that no user approval is required before proceeding. In an agent context, writing files to the user's workspace without an explicit confirmation step can cause unintended modifications, overwrite prior state, or normalize broader autonomous file-system side effects.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

Lines L06-L22 define a prompt template ending with an inline '[Answer]:' multiple-choice interaction for the chat session. However, L44 states that clarification or user feedback questions must always be placed in .md files and specifically says not to place multiple-choice questions inline in chat, which directly contradicts the template's documented behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

This markdown file tells the user the workflow will analyze their workspace, which implies access to local project files and possibly sensitive repository contents. The welcome message does not include any warning or disclosure about reviewing existing code or project data before that step occurs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill instructs the agent to write project files and append to an audit log, but it does not clearly warn the user up front that executing this stage will modify repository contents. In a development workflow skill this is expected behavior, but without explicit disclosure and confirmation boundaries, the agent could make persistent changes a user did not anticipate, including creating misleading audit entries that appear authoritative.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.