ClawHub
Back to skill

Security audit

Clawsouls Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill openly manages agent persona files and registry actions, with clear user-confirmation guidance and no evidence of hidden or destructive behavior.

Install from a trusted pinned source when possible, review any soul before activating it, and confirm before running commands that switch personas, publish content publicly, or sync memory to a remote.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · HERMES_ADAPTER.md (reported line 19)May include surrounding context.

bash
# from a URL
hermes skills install https://raw.githubusercontent.com/clawsouls/clawsouls-skill/main/SKILL.md

# or clone into the skills directory
git clone https://github.com/clawsouls/clawsouls-skill ~/.hermes/skills/clawsouls

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The markdown says the skill can be invoked by 'just ask: "install a soul"', which is a broad natural-language phrase that could overlap with ordinary conversation rather than a narrowly scoped command. The file does not provide constraints, exclusions, or negative examples clarifying when that phrase should or should not activate the skill.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
80% confidence
Finding

The README instructs users to run npx skills add clawsouls/clawsouls-skill without pinning an exact package version. This can cause installation of whatever version is current at execution time, increasing supply-chain risk if the upstream package is compromised, replaced, or publishes a malicious update. In this skill’s context, that is more sensitive because the installed package can manage persona files, interact with registries, and potentially affect agent workspace behavior.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

Line L017 presents an operational instruction entirely in Korean, with no accompanying translation or indication that the user can choose another language. The policy requires avoiding forced language or locale constraints unless the skill offers opt-in or clearly documents a justified regional limitation.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The dependency is specified with a caret range (^0.1.0), which allows installation of newer compatible releases within the 0.x line. This creates supply-chain risk because a future upstream release could change behavior or introduce malicious code without this skill explicitly reviewing or pinning that version. In a skill that manages agent personas, may publish content, and can interact with networked services, dependency drift is more sensitive because the package likely runs with access to workspace files and user context.

Content

Scanner excerpt · package.json (reported line 21)May include surrounding context.

json
},
  "homepage": "https://clawsouls.ai",
  "dependencies": {
    "clawsouls": "^0.1.0"
  }
}

Static analysis

No suspicious patterns detected.