ClawHub
Back to skill

Security audit

智能内容归档

Security checks for vulnerabilities and agentic risk

Overview

This archive/search skill is mostly coherent, but its instructions broaden into unrelated automation and do not clearly scope how archived content is handled by LLM/API services.

Review this skill carefully before installing. Use it only for content archiving and search, avoid giving it sensitive files or private notes unless you are comfortable with LLM/API processing, and do not rely on its broad automation, CI/CD, environment-management, or ETL wording without tighter scoping.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The manifest and description present the skill as an archiving/search tool, but the 'Use when' text broadens it to project management, task planning, progress tracking, and team collaboration. This scope drift can cause the agent to invoke a skill with exec capability in contexts unrelated to archiving, increasing the chance of unnecessary file/system access and misuse beyond user expectations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The invocation guidance is inconsistent and overly broad for an archive skill, which weakens safe skill selection and user consent. In practice, ambiguous routing can trigger this skill in unrelated workflows where it may process sensitive team/project data or use exec unnecessarily, creating avoidable exposure and confusion about its true function.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill describes extracting full external content, generating summaries/tags, and performing semantic search via an LLM/API, but it does not clearly warn users that fetched content, local file content, URLs, notes, and associated metadata may be transmitted to an external model or service. This creates a meaningful confidentiality and privacy risk, especially if users archive proprietary documents, internal PDFs, private notes, or sensitive links under the assumption processing is local.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The scenario section expands the skill from content archiving into general automation, CI/CD, environment management, ETL, and interface integration. Because the skill declares access to exec, read, glob, and grep, this broadened positioning can lead operators or routing logic to apply it to high-risk operational tasks that were not narrowly designed or safety-scoped for archiving.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.