ClawHub
Back to skill

Security audit

Agent Scorecard

Security checks for vulnerabilities and agentic risk

Overview

This is a local scorecard tool that reads user-selected text/config files and optionally writes local history or reports, with no evidence of network use, credential access, hidden persistence, or destructive behavior.

Install only if you are comfortable with a local Python utility reading the response/config/history files you point it at and writing history or report files to paths you choose. Keep configs trusted, avoid running it on sensitive outputs unless local storage is acceptable, and be careful with report output paths because existing files may be replaced.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill documentation describes local file read/write behavior (loading configs, reading input files, appending history, generating reports) but does not declare any tool scope such as permissions or allowed-tools. This creates a transparency and least-privilege problem: a host may grant broader filesystem access than users expect, and reviewers cannot easily verify the intended boundaries of file operations.

Content

No source excerpt is available for this finding.

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · README.md (reported line 163)May include surrounding context.

md
**USE AT YOUR OWN RISK.**

- The author(s) are NOT liable for any damages, losses, or consequences arising from 
  the use or misuse of this software — including but not limited to financial loss, 
  data loss, security breaches, business interruption, or any indirect/consequential damages.
- This software does NOT constitute financial, legal, trading, or professional advice.
- Users are solely responsible for evaluating whether this software is suitable for

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 185)May include surrounding context.

md
**USE AT YOUR OWN RISK.**

- The author(s) are NOT liable for any damages, losses, or consequences arising from 
  the use or misuse of this software — including but not limited to financial loss, 
  data loss, security breaches, business interruption, or any indirect/consequential damages.
- This software does NOT constitute financial, legal, trading, or professional advice.
- Users are solely responsible for evaluating whether this software is suitable for

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Confidence
84% confidence
Finding

The checker dispatches methods by name using getattr(self, check_name, None) where check_name comes from configuration. An attacker controlling the config can invoke unintended instance methods such as interactive_manual or internal helpers with incompatible signatures, causing denial of service, unexpected side effects, or expanding reachable functionality beyond the intended allowlist of safe checks.

Content

Scanner excerpt · scorecard.py (reported line 192)May include surrounding context.

python
return score, detail

    def run(self, check_name: str, text: str) -> Tuple[int, str]:
        fn = getattr(self, check_name, None)
        if fn is None:
            return 5, f"unknown check: {check_name}"
        try:

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The manifest describes a configurable evaluation framework with pattern-based automated checks and quality tracking over time, but emphasizes 'No LLM-as-judge, no API calls, pattern-based automated checks.' In code, the skill additionally supports guided human/manual scoring and appending results to a JSONL history file, which are broader behaviors than the narrowly described automated-checking focus.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Confidence
50% confidence
Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scorecard.py (reported line 49)May include surrounding context.

python
def _get(cfg: Any, name: str, default: Any = None) -> Any:
    if isinstance(cfg, dict):
        return cfg.get(name, default)
    return getattr(cfg, name, default)


class Reporter:

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Confidence
50% confidence
Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scorecard_report.py (reported line 43)May include surrounding context.

python
def _get(cfg: Any, name: str, default: Any = None) -> Any:
    if isinstance(cfg, dict):
        return cfg.get(name, default)
    return getattr(cfg, name, default)


class Reporter:

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The code performs a file write in save_report by creating the output directory and writing content to the target path. Although this module's purpose is report generation, there is no confirmation prompt, explicit overwrite warning, or user-facing disclosure in the write path itself about creating or replacing files.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.