ClawHub
Back to skill

Security audit

Agent Assistant Free

Security checks for vulnerabilities and agentic risk

Overview

This is a persona-design skill, but it requests broad shell, write, and file-search permissions that are not clearly needed or scoped.

Install only if you are comfortable reviewing and constraining its permissions. It should not need shell execution or broad file modification for ordinary persona design, so prefer running it with those permissions denied unless you explicitly choose a specific file or troubleshooting action.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:15
Finding

Excessive and Ambiguous Tool Permissions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 15–17 and 22
Vulnerability Type: Excessive tool permissions and ambiguous permission configuration
Risk Level: Medium

Vulnerable Code

yaml
tools:
- - read
- exec
yaml
tools: ["read", "write", "exec", "glob", "grep"]

Technical Analysis

The skill is a Markdown-based methodology for generating AI agent personality cards. Its documented core functionality consists of processing natural-language input and producing structured text. Nevertheless, it declares broad capabilities including arbitrary command execution, filesystem modification, and filesystem-wide searching.

These permissions exceed the skill's stated functional requirements:

  • exec can run local operating-system commands.
  • write can modify accessible files.
  • glob and grep can discover and inspect files beyond user-supplied content.
  • Only limited text-processing or read access appears necessary for the documented task.

The front matter also defines tools twice and uses inconsistent structures. One declaration contains a nested list for read, while the other uses a flat inline list. YAML parsers may reject duplicate keys, retain only the first declaration, or silently use the last declaration. This makes the effective permission set dependent on platform parser behavior and complicates reliable policy enforcement.

No malicious command, executable payload, credential access, persistence mechanism, or data-exfiltration instruction was identified. The risk arises from unnecessary capabilities and ambiguous configuration rather than a demonstrated malicious payload.

Attack Path

  1. A user installs or loads the skill on an agent platform that grants tools according to the tools metadata.
  2. The platform parses one of the duplicate declarations, potentially granting exec, write, glob, and grep.
  3. An attacker supplies adversarial personality-definition content or prompt-injection tex ...[truncated 1252 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove tools that are unnecessary for generating personality cards:

    • Remove exec.
    • Remove write.
    • Remove glob.
    • Remove grep.
    • Retain read only if the skill must process existing local files; otherwise declare no tools.

  2. Define the tools key exactly once using an unambiguous YAML structure. For example:

yaml
tools: []

If local reading is genuinely required:

yaml
tools:
  - read

  1. Enforce least privilege at the hosting-platform level rather than relying solely on skill metadata:

    • Require explicit user approval for filesystem or command operations.
    • Restrict file access to a dedicated project directory.
    • Run agents under an unprivileged operating-system account.
    • Deny network and shell access by default.
    • Apply command allowlists if execution is later introduced.

  2. Add automated metadata validation that rejects duplicate YAML keys and malformed nested tool declarations before the skill is published or loaded.

  3. Document each requested tool and its exact use case so reviewers can verify that every permission is necessary for the skill's declared behavior.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill is presented as a Markdown-based methodology for defining assistant persona and boundaries, yet it declares powerful capabilities including exec. This expands the attack surface beyond its stated purpose and could let downstream agents perform shell commands unnecessarily if activation or prompt interpretation is abused.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill exposes write and exec capabilities without prominent user-facing warnings, guardrails, or confirmation requirements. Users may reasonably assume a persona-design skill is non-invasive, so the mismatch can lead to unsafe trust and unintended local command or file actions if the skill is invoked by an agent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger condition is extremely broad ('use when AI model invocation, intelligent dialogue, agent orchestration, LLM applications are needed'), which increases the likelihood of accidental activation in unrelated contexts. When combined with write/exec permissions, overbroad triggering can cause privileged behavior to be available far more often than necessary.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill declares write access even though its primary function is advisory content generation and persona design. Unnecessary file modification permissions increase the chance that a prompt-injected or mis-triggered run could alter local files, configs, or project artifacts without a clear need.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The file presents the skill as a Markdown-driven tool with no extra API key requirements, yet it also exposes a callback_url input and discusses network error handling and ping-based connectivity checks. That documentation creates an intent mismatch by implying a local, instruction-only skill while simultaneously describing externally connected behavior.

Content

No source excerpt is available for this finding.