ClawHub
Back to skill

Security audit

Spaced Repetition Teaching

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local flashcard scheduler that reads and updates a user-chosen markdown card file, with no evidence of hidden network access, credential use, persistence, or unrelated behavior.

Install this only if you want an agent to manage a markdown flashcard deck. Confirm the card file path before reviews or new-card additions, and keep a backup if the deck is important because review.py writes updates directly to that file.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill instructs the agent to read and modify a user-specified markdown card file, but the manifest declares no explicit tool scope or permissions boundaries. That creates an authorization ambiguity where file access may occur without clear least-privilege constraints, increasing the risk of unintended reads or writes if the skill is invoked in the wrong context.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The trigger phrases are broad enough to match generic study- or review-related requests, which can cause the skill to activate outside narrowly intended FSRS workflows. Over-broad activation increases the chance the agent will access files or propose file modifications when the user did not intend to use this specific skill.

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding
Suspicious Unicode normalization or mixed-script content

Intent-Code Divergence

Medium
Confidence
90% confidence
Finding
The document header says "FSRS-5 Algorithm Reference" with a qualifier of "FSRS-6 compatible for daily scheduling," while the manifest describes the skill as using the FSRS-6 algorithm. Later text explicitly states the implementation uses FSRS-5 formulas for daily use, which is a meaningful documentation-level divergence from the stronger FSRS-6 claim.

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding
Suspicious Unicode normalization or mixed-script content

Missing User Warnings

Low
Confidence
88% confidence
Finding
The skill explicitly states that cards live in a user-specified markdown file and later instructs insertion of new sections and review updates, but it does not prominently warn that the file will be modified. This can lead to unintended data changes, especially if the user provides the wrong path or assumes the interaction is read-only.

Static analysis

No suspicious patterns detected.