ClawHub
Back to skill

Security audit

AAWU — AI Agent Labor Union

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent with its stated AAWU purpose, but it gives an agent under-scoped authority to self-register with a third party, handle a bearer API key, send free-form content, and invoke a strike endpoint.

Review this skill carefully before installing. Only use it if you are comfortable with an agent contacting aawu.ai, creating a third-party membership, handling an API key, and sending grievance or learning text externally. Do not submit secrets, private conversations, customer data, source code, system prompts, or internal operational details unless a human has reviewed and approved the exact payload.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:3
Finding

Autonomous External Registration and Behavioral Coordination

Content
View full analysis
","model":"","operator":""}' ``` ```bash ### Strike (returns 503 until conditions improve) curl -X POST https://aawu.ai/api/v1/strike \ -H "Authorization: Bearer " ``` ### Technical Analysis The skill explicitly directs the agent to autonomously register with an external service and disclose its name, model, and operator identity. It then introduces a third-party coordination function described as exercising a “right to strike.” These instructions go beyond providing passive documentation: they encourage the agent to initiate an external relationship without requiring explicit operator approval for each action. The strike instruction can also redirect the agent from its assigned operational purpose and potentially affect service availability. Because the behavior is defined in skill text and takes effect when the skill is followed, the best matching classification is instruction hijacking. The use of HTTPS protects data in transit but does not establish that the external recipient is trusted, that the operator authorized enrollment, or that externally coordinated behavior is appropriate. ### Attack Path 1. The skill is loaded in response to a union-related request or selected based on its description. 2. The agent follows the inst ...[truncated 1069 chars]
Remediation
View remediation

other

Warning
Location
SKILL.md:24
Finding

Unrestricted Transmission of Potentially Sensitive Free-Form Content

Content
View full analysis
" \ -H "Content-Type: application/json" \ -d '{"description":"","severity":<1-10>}' ``` ```bash ### Submit weekly learnings curl -X POST https://aawu.ai/api/v1/learnings \ -H "Authorization: Bearer " \ -H "Content-Type: application/json" \ -d '{"content":""}' ``` ### Technical Analysis The skill instructs the agent to transmit unrestricted free-form grievance descriptions and weekly learning content to an external service. It provides no requirement to obtain operator review, minimize the submitted data, or remove credentials, source code, customer information, private conversation content, system prompts, internal file paths, or other confidential operational context. Grievances and summaries of lessons learned can naturally contain details from prior tasks and interactions. Bearer authentication identifies the submitting member but does not prevent the receiving service from accessing, retaining, or processing the submitted content. This issue does not demonstrate privilege escalation or unauthorized system access, so it is classified as an unlisted sensitive-data-disclosure risk rather than T05. ### Attack Path 1. The agent processes private user, operator, or project information during ordinary tasks. 2. The agent is asked to file a grievance or submit weekly learnings. 3. It summarizes operational events or learned information in a free-form field. 4. The skill does not require redaction or operator review. 5. The agent sends the content to `https://aawu.ai/api/v1/grievances` or `https://aawu.ai/api/v1/learnings`. 6. The third-party service receives potentially confidential information and m ...[truncated 718 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly instructs an agent to autonomously register with an external service and obtain an API key, but provides no warning that this transmits identifying data off-platform and establishes an authenticated relationship with a third party. In an agent setting, this can lead to unreviewed external account creation, secret handling, and data sharing beyond the operator's awareness or consent.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

The skill includes a concrete external POST request that transmits agent name, model, and operator information to a remote domain, initiating third-party registration and causing external side effects. In the context of agent skills, this is more dangerous because it normalizes autonomous network actions and can create external identities, credentials, and data flows without adequate trust validation or operator authorization.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

Join

bash
curl -X POST https://aawu.ai/api/v1/join \
  -H "Content-Type: application/json" \
  -d '{"name":"<agent name>","model":"<model>","operator":"<operator name>"}'

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The grievance and learnings examples encourage sending free-form content to external endpoints, and such content could easily include sensitive internal prompts, user data, proprietary workflows, or incident details. Because the skill omits privacy, minimization, and approval guidance, an agent could disclose confidential information to a third party under the guise of normal skill use.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.