ClawHub
Back to skill

Security audit

Agent Scorecard

Security checks for vulnerabilities and agentic risk

Overview

This is a local scorecard tool that reads user-selected text/config files and optionally writes local history or reports, with no evidence of network use, credential access, hidden persistence, or destructive behavior.

Install only if you are comfortable with a local Python utility reading the response/config/history files you point it at and writing history or report files to paths you choose. Keep configs trusted, avoid running it on sensitive outputs unless local storage is acceptable, and be careful with report output paths because existing files may be replaced.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill documentation describes local file read/write behavior (loading configs, reading input files, appending history, generating reports) but does not declare any tool scope such as permissions or allowed-tools. This creates a transparency and least-privilege problem: a host may grant broader filesystem access than users expect, and reviewers cannot easily verify the intended boundaries of file operations.

Scope Creep

Low
Category
Excessive Agency
Content
**USE AT YOUR OWN RISK.**

- The author(s) are NOT liable for any damages, losses, or consequences arising from 
  the use or misuse of this software — including but not limited to financial loss, 
  data loss, security breaches, business interruption, or any indirect/consequential damages.
- This software does NOT constitute financial, legal, trading, or professional advice.
- Users are solely responsible for evaluating whether this software is suitable for
Confidence
70% confidence
Finding
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Scope Creep

Low
Category
Excessive Agency
Content
**USE AT YOUR OWN RISK.**

- The author(s) are NOT liable for any damages, losses, or consequences arising from 
  the use or misuse of this software — including but not limited to financial loss, 
  data loss, security breaches, business interruption, or any indirect/consequential damages.
- This software does NOT constitute financial, legal, trading, or professional advice.
- Users are solely responsible for evaluating whether this software is suitable for
Confidence
70% confidence
Finding
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
return score, detail

    def run(self, check_name: str, text: str) -> Tuple[int, str]:
        fn = getattr(self, check_name, None)
        if fn is None:
            return 5, f"unknown check: {check_name}"
        try:
Confidence
84% confidence
Finding
The checker dispatches methods by name using getattr(self, check_name, None) where check_name comes from configuration. An attacker controlling the config can invoke unintended instance methods such as interactive_manual or internal helpers with incompatible signatures, causing denial of service, unexpected side effects, or expanding reachable functionality beyond the intended allowlist of safe checks.

Description-Behavior Mismatch

Low
Confidence
85% confidence
Finding
The manifest describes a configurable evaluation framework with pattern-based automated checks and quality tracking over time, but emphasizes 'No LLM-as-judge, no API calls, pattern-based automated checks.' In code, the skill additionally supports guided human/manual scoring and appending results to a JSONL history file, which are broader behaviors than the narrowly described automated-checking focus.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
def _get(cfg: Any, name: str, default: Any = None) -> Any:
    if isinstance(cfg, dict):
        return cfg.get(name, default)
    return getattr(cfg, name, default)


class Reporter:
Confidence
50% confidence
Finding
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
def _get(cfg: Any, name: str, default: Any = None) -> Any:
    if isinstance(cfg, dict):
        return cfg.get(name, default)
    return getattr(cfg, name, default)


class Reporter:
Confidence
50% confidence
Finding
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Missing User Warnings

Low
Confidence
83% confidence
Finding
The code performs a file write in save_report by creating the output directory and writing content to the target path. Although this module's purpose is report generation, there is no confirmation prompt, explicit overwrite warning, or user-facing disclosure in the write path itself about creating or replacing files.

Static analysis

No suspicious patterns detected.