ClawHub
Back to skill

Security audit

Build

Security checks for vulnerabilities and agentic risk

Overview

This build skill is a Markdown-only automation workflow for implementing plan tasks, running checks, updating progress, and committing changes, with no evidence of hidden execution, exfiltration, or persistence beyond the project workflow.

Install this only if you want an agent to actively modify a repository, run local build/test/lint commands, update plan files, and make git commits. Review the referenced plan before invoking it, and be cautious in workspaces where cross-project code search or session-history search could expose private context.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill is authorized to use exec and repeatedly instructs the agent to run build, test, lint, integration, device, and git commands, yet the user-facing summary does not clearly warn that shell commands and repository modifications will be executed automatically. In an agent environment, this lack of explicit disclosure can lead users to invoke the skill without understanding it may change files, create commits, run local binaries, or interact with connected simulators/devices.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest description focuses on executing implementation-plan tasks with TDD, auto-commit, and phase gates. The documented behavior goes beyond that scope by launching web apps or mobile apps, navigating UI, inspecting logs, and taking screenshots, which are broader QA/visual testing operations not conveyed by the manifest.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The skill metadata and instructional content are partially written in Chinese, while other sections are in English, with no indication that the user can choose their preferred language. Under SQP-3, language or locale constraints should either be user-selectable or clearly documented and justified.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The manifest describes a build-oriented execution engine, but the documentation instructs use of session_search, project_code_search across projects, and codegraph queries for architecture/context loading. These are materially broader discovery capabilities than the manifest communicates, especially cross-project reuse lookup.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The text at L065 says 'Do NOT read source code files at this stage. Only docs.' Yet the subsequent execution guidance relies on project_code_search and codegraph queries over source files and imports as part of research. This is an intent/documentation contradiction about whether source analysis is disallowed at that point.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.