ClawHub
Back to skill

Security audit

RALSTP Consultant

Security checks for vulnerabilities and agentic risk

Overview

This skill is a planning-analysis helper with an optional local PDDL parser, and I did not find hidden persistence, credential access, network execution, or destructive behavior.

Install only if you want an advisory planning framework for complex multi-actor tasks. Treat its formal PDDL difficulty score as a rough heuristic, not a precise implementation of the thesis metric, and review outputs before applying them to sensitive operational plans.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The invocation guidance is broad enough to capture generic planning, analysis, and problem-solving requests, which can cause the skill to trigger outside its intended niche. Over-broad auto-invocation increases the chance the agent applies this methodology to sensitive operational, migration, or decision-support tasks without clear user intent, potentially shaping outputs inappropriately or exposing adjacent capabilities.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/analyze.py (reported line 82)May include surrounding context.

python
# Types
        types_node = find_section(self.domain, ':types')
        if types_node:
            # Simplistic type parsing (a b - parent)
            current_objs = []
            for token in types_node[1:]:
                if token == '-':

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The docstring at L208-L210 claims the method uses a difficulty metric based on agents multiplied by entanglement and defines entanglement in terms of shared static resources. The actual code at L212-L225 never computes entanglement or such a product; it only derives a ratio of agent instances to total objects and labels complexity from agent-count cutoffs.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.