ClawHub
Back to skill

Security audit

LocalSquare - Local Business Ads

Security checks for vulnerabilities and agentic risk

Overview

This payment-capable advertising skill is clearly disclosed, requires explicit user approval before spending, and contains no local executable code or hidden persistence.

Before installing or using this skill, treat it as a real purchase and public posting workflow: verify the recipient/payment details, never provide private keys to the agent, confirm exactly which town and cell are being claimed, and clarify the lifetime-versus-expiration wording with LocalSquare if that term matters to you.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The skill's activation guidance is broad enough to match ordinary marketing-related conversations, which increases the chance an agent invokes a payment-capable skill in contexts where the user did not specifically request this service. In this skill, that risk is amplified because the workflow can culminate in real financial transactions and disclosure of business contact data, so accidental or premature invocation could steer users toward unintended purchases.

Intent-Code Divergence

Low
Confidence
95% confidence
Finding
The skill repeatedly states that agent-claimed early adopter pins are permanent and have no renewal or expiry, including at L028, L076, and L303. However, the success response example includes an `expiresAt` field with a concrete future date, which directly contradicts the stated permanence and could mislead integrators about the lifecycle of claimed pins.

Static analysis

No suspicious patterns detected.