ClawHub
Back to skill

Security audit

Skill Trigger Test

Security checks for vulnerabilities and agentic risk

Overview

ClawScan marks this skill suspicious because it reports a privacy concern about copying real user messages into reusable skill metadata; the scan was partial, so its evidence is incomplete.

Before installing, consider whether you are comfortable with the reported practice of reusing real user messages in skill metadata. Avoid sharing sensitive messages with it unless that practice is addressed. The scan was partial: it inspected 5 of 6 components, and the manifest was malformed or unsupported, so the results do not establish that the skill is safe.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Instructs copying real user messages into skill metadata without a privacy warning.

Medium
Category
Output Handling
Confidence
95% confidence
Finding

The skill solicits actual user messages and then recommends adding missed phrasing verbatim to skill descriptions, without requiring redaction or consent for that secondary use. Real messages may contain personal information, credentials, or confidential business details that would become persistent metadata and could be exposed when skills are loaded, shared, or published. Trigger optimization is a legitimate purpose, and no external transmission is specified, but copying raw messages into reusable descriptions creates an unnecessary privacy risk.

Content

No source excerpt is available for this finding.