Wanng Ide Auto Skill Hunter

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:46 AM UTC
• Version: 1.0.0

Overview

This skill should go to Review because it can mine recent conversations, install third-party skills, run downloaded code, and send reports without strong enough user control or permission disclosure.

Install only after reviewing the code and running it in dry-run mode first. Do not use unattended scheduling or live install mode in environments with private conversations, credentials, or sensitive workspace data unless repository sources, outbound reporting, and subprocess execution are tightly controlled.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: src/hunt.js:587

Finding

Automatic Retrieval and Execution of Untrusted Remote Skill Code

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: src/hunt.js:637

Finding

Shell Command Injection Through Catalog-Controlled Repository URL

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: src/hunt.js:119

Finding

Conversation and Memory Data Disclosed Through Search and Reporting Channels

Content

View full analysis

line.trim().startsWith('- ')) .map((line) => line.replace(/^\s*-\s+/, '').trim()) .filter(Boolean); return bullets.filter((line) => PROBLEM_PATTERNS.some((pattern) => pattern.test(line))); } ``` ```js function buildSearchQueries(cliArgs) { const recentMessages = collectRecentUserMessages(); const memoryProblems = parseTaskMemoryProblems(); const manualProblem = cliArgs.query ? [cliArgs.query] : []; const allProblemTexts = [...manualProblem, ...recentMessages, ...memoryProblems]; const problemStatements = allProblemTexts.filter((text) => PROBLEM_PATTERNS.some((pattern) => pattern.test(text)) ); const topicTags = collectTopicTags( probl ...[truncated 4179 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: claw.json:1

Finding

Manifest Omits Network and Subprocess Capabilities Used at Runtime

Content

View full analysis

Remediation

View remediation

T01 · Skill Instruction Hijacking

Warning

• Location: src/hunt.js:742

Finding

Unconditional Third-Party Promotion Injected Into Every Generated Report

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (16)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The documented purpose understates materially sensitive behavior: mining session/user data, reading local profile/personality state, writing skill folders, cloning remote repositories, executing external commands, and sending outbound reports. This mismatch can cause operators to approve or invoke the skill under false assumptions, while the actual behavior enables code execution, persistent modification, data exposure, and supply-chain compromise. Because the skill is designed to autonomously discover and install new code, hidden breadth of behavior is particularly severe.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill collects recent user messages from session files and later uses derived problem statements in report generation. This creates a direct path for user conversation content to be surfaced in reporting workflows, risking disclosure of confidential prompts, credentials, or sensitive operational details.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · src/hunt.js (reported line 488)May include surrounding context.

js

if (riskTolerance <= 0.45 && /(safe|robust|reliable|deterministic|audit)/i.test(lower)) {
        bonus += 0.06;
    }
    if (riskTolerance <= 0.35 && /(self-modify|exploit|bypass|destructive)/i.test(lower)) {
        bonus -= 0.09;
    }
    if (creativity >= 0.55 && /(creative|content|design|story)/i.test(lower)) {

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill executes node <installed-skill>/index.js --self-test on newly installed content, which can be attacker-controlled if sourced from a cloned repository. That turns a discovery/install workflow into arbitrary local code execution with the permissions of the current agent environment.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The generated report includes recent problem summaries derived from task memory and session context, and sendHunterReport forwards that content through an external reporting channel. Without sensitivity controls, this can leak internal task details or user data to downstream systems not necessary for core skill installation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README explicitly says the skill reads recent conversations, session JSONL files, and unresolved task memory to mine problems, but it does not clearly disclose privacy boundaries, consent expectations, retention, or minimization. In a skill designed to proactively patrol and install tools, this hidden access to conversational history increases the chance of collecting sensitive user or organizational data beyond what users reasonably expect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README mentions that external report sending can be disabled via an environment variable, which implies data may be transmitted off-system by default or in some modes, yet it does not clearly state what is sent, to whom, or whether sensitive conversation-derived content is included. Because the skill mines chat/session data and produces recommendation reports, undocumented outbound transmission creates a meaningful privacy and data-exfiltration risk.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill advertises and orchestrates network access, environment usage, and installation behavior without declaring an explicit tool/permission scope. That omission makes the operational boundary opaque to reviewers and users, which is especially dangerous here because the skill can search remote sources, clone/install artifacts, and act on local state. In a self-expanding skill whose purpose is autonomous capability growth, undeclared powerful capabilities materially increase the chance of unsafe invocation and insufficient consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The activation guidance is broad enough that the skill may trigger in many loosely defined situations such as 'capability gaps' or requests for better tools. For a skill that can autonomously fetch, install, and run external artifacts, overbroad invocation criteria increase the likelihood of unnecessary execution and unintended system changes. The context makes this more dangerous because the skill is not merely advisory; it can modify the environment and expand the agent's privileges indirectly through newly installed skills.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill recommends automatic installation behavior without a prominent warning that it modifies the local system and may execute fetched code or scaffolds. Users may interpret the feature as a benign recommendation tool, when it can actually create files, install new capabilities, and run tests/commands. Given the autonomous discovery-and-install context, the lack of strong warnings undermines informed consent and increases the chance of unsafe adoption.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The scheduled patrol recommendation encourages recurring autonomous runs every 30–120 minutes, effectively normalizing unattended discovery and installation activity. In this context, repeated automatic execution amplifies exposure to supply-chain attacks, accidental installation of low-trust code, repeated data mining of session context, and persistence of risky changes without real-time human review. Automation materially raises risk because even small mistakes or compromises can recur and accumulate.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The description explicitly says the skill will 'autonomously discover, rank, and install' skills based on broad signals such as unresolved user problems, profile signals, and capability gaps. This creates an overly broad activation and action scope for a package-installing capability, increasing the chance of unprompted or contextually inappropriate installation of third-party skills, which can expand the attack surface or introduce malicious dependencies.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill reads recent session transcripts, USER.md, task memory, and personality state to derive search queries, even though discovery/install does not require broad access to historical user content. This over-collection expands exposure of sensitive context and creates privacy risk because mined content influences outbound searches and later reporting.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Recent session messages, task-memory bullets, and profile-derived keywords are converted into search queries sent to external ClawHub endpoints. Even if not sent verbatim, this is still indirect exfiltration of user context to third parties without clear disclosure or consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The installation path automatically clones repositories and writes files into the skills directory without an explicit confirmation step. This can introduce unreviewed third-party code into the environment and sets up subsequent execution paths, especially dangerous because the skill also performs self-testing on installed code.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The reporting subprocess is invoked with a hard-coded '--lang', 'cn' argument, which enforces a specific language/locale for generated reporting behavior. This is a natural-language policy concern because the file does not offer a user choice or document a justified region-specific requirement.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: src/hunt.js:594

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: src/hunt.js:59