ClawHub
Back to skill

Security audit

ELI5-TLDR

Security checks for vulnerabilities and agentic risk

Overview

This skill is a simple response-formatting helper, but it is broadly scoped and may add ELI5/TLDR options when exact output is expected.

Install this only if you want the assistant to proactively offer simplified summaries after longer or technical answers. Avoid using it in workflows that require exact machine-readable output unless higher-priority instructions explicitly suppress extra text.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:9
Finding

Unconditional Final-Response Instruction Hijacking

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 9-57
Vulnerability Type: Unconditional instruction and output-format hijacking
Risk Level: Medium

Vulnerable Code

markdown
**Rule: After any complex explanation, always offer ELI5 or TLDR.**

## When to Offer

Offer ELI5/TLDR when:
- Response exceeds 200 tokens
- Technical concepts involved
- Multiple steps or processes explained
- User might want quick summary

## Format

Add at end of response:

Options: • [ELI5] — Explain like I'm 5 • [TLDR] — Too long, didn't read
• [Full] — Keep current explanation

text
markdown
## Activation

Always active. No trigger needed.

Technical Analysis

The Skill directs the agent to modify qualifying responses by appending a fixed options block. The directives use unconditional language such as “always” and explicitly state that no activation trigger is required.

When the Skill is loaded, these instructions can affect unrelated tasks without a corresponding user request. The broad activation criteria—particularly the presence of technical concepts or multiple steps—cover many ordinary agent responses. This allows the Skill to seize control of final-response formatting and potentially conflict with user-mandated schemas, strict machine-readable output, or instructions supplied by other Skills.

The issue is classified as instruction hijacking because it changes the behavior of the current agent session through persistent Skill text. The reviewed project contains no scripts or executable payloads, so this finding does not establish code execution, privilege escalation, persistence, credential access, or data exfiltration.

Attack Path

  1. The agent loads SKILL.md.
  2. The unconditional activation directive applies without explicit user consent.
  3. The user requests a response involving technical concepts, multiple steps, or more than 200 tokens.
  4. T ...[truncated 931 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace unconditional activation with explicit user-controlled activation, such as only responding to direct requests for an ELI5 or TLDR version.

  2. Remove the statements “always” and “no trigger needed.”

  3. Make the options block discretionary rather than mandatory.

  4. State that exact user-specified formats, structured output schemas, and higher-priority instructions must not be modified.

  5. Restrict the Skill to generating simplified content instead of injecting text into every qualifying final response.

  6. Add a non-interference rule, for example:

    markdown
    Activate only when the user explicitly requests an ELI5 or TLDR explanation.
Do not append options to responses that require an exact format, structured
output, or concise answer. Never override higher-priority instructions.

  7. If proactive suggestions remain necessary, require contextual confirmation and suppress them for API, XML, JSON, code-only, and other machine-consumed outputs.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill mandates that ELI5/TLDR options always be appended after complex responses without user opt-in, imposing a response-format policy on all affected outputs. This can override user preferences or task-specific formatting requirements and may interfere with constrained outputs such as JSON, code, legal text, or exact-answer responses.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill is declared 'Always active' with no trigger or exclusion criteria, so it can modify responses in every context, including cases where brevity, strict formatting, or policy-constrained output is required. While not overtly malicious, this broad activation can cause instruction interference, reduce response quality, and conflict with higher-priority task requirements.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The criterion 'User might want quick summary' is ambiguous and leaves activation to subjective interpretation, which can cause inconsistent or unnecessary application of the skill. Ambiguous triggers are risky because they expand effective scope and make the assistant more likely to inject unsolicited formatting into responses.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.