ClawHub
Back to skill

Security audit

pre-compact

Security checks for vulnerabilities and agentic risk

Overview

The skill saves session handoffs and updates documentation, with a disclosed option to add a persistent handoff reminder.

Use the default approval mode to review proposed changes, especially the global instruction reminder that can affect future projects. Auto mode applies all proposed updates. Check handoffs for sensitive conversation details before sharing or committing them; the skill explicitly excludes secrets.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md
I will compact this context soon. The summary can be wrong. Files are the
source of truth. Move everything a fresh session needs from this conversation
into files. Mode: $ARGUMENTS. `auto` or `a` means: apply all proposed updates
without asking.

Write `.agents/compact-handoff/YYMM-DD-HHMM-<short-slug>.md`. Start with the
line `# Handoff <date> <time> <repo>@<branch>`. Then write these sections:

The skill extends project-scoped documentation updates to persistent, user-wide agent instructions.

Medium
Category
Excessive Agency
Confidence
94% confidence
Finding

The manifest describes writing a session handoff and updating the project's durable documentation. L39–L43 additionally direct the agent to propose modifying global agent instructions, which can then be applied through the approval or auto workflow at L45–L47. This persists behavioral instructions beyond the current project and session, exceeding the described scope even though changes are approval-gated outside auto mode.

Content

No source excerpt is available for this finding.