ClawHub
Back to skill

Security audit

Blog Watcher

Security checks for vulnerabilities and agentic risk

Overview

This is a sparse but coherent blog/RSS monitoring skill with no bundled code, credentials, persistence, or hidden behavior found.

This skill appears safe to install as a simple blog/RSS helper, but users should treat it as lightly documented: confirm what files it will write and which feeds or web pages it will fetch before asking it to run broad monitoring tasks.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
96% confidence
Finding
The invocation example is overly broad and generic ('Help me with blog watcher'), which can cause the skill to activate in response to ambiguous everyday language rather than an explicit RSS/blog-monitoring request. In a tool-enabled skill that includes bash, web fetching, and file writing, ambiguous activation expands the chance of unintended tool use or user confusion about what actions may be taken.

Missing User Warnings

Low
Confidence
85% confidence
Finding
The skill advertises web-fetching and file-writing capabilities without any warning, guardrails, or explanation of operational limits. While not inherently malicious, this can normalize potentially impactful actions and makes it easier for the skill to retrieve untrusted remote content or write local artifacts without users understanding the consequences.

Static analysis

No suspicious patterns detected.