ClawHub
Back to skill

Security audit

Edit Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says: it helps review and edit existing agent-skill files, with no hidden network, credential, persistence, or destructive behavior found.

Install this only if you want an assistant to help review or edit agent-skill files. Use review-only mode for security-sensitive skills, and inspect diffs carefully when edits touch safety rules, tool permissions, routing, or installation metadata.

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
This is a mismatch because the declared purpose describes a skill that performs substantive review/editing of another skill's content, but the actual code does not review or edit anything. Instead, it acts as a validator for a specific package structure and document contract, checking file existence and required metadata/text. That validation behavior is not accurately represented by the description, and the primary purpose differs materially from the claimed editing/cleanup role.

Vague Triggers

Medium
Confidence
83% confidence
Finding
The trigger language is broad enough to activate on generic editing requests, which can cause the wrong skill to take over and modify agent-skill files when the user intended ordinary prose editing. Misrouting is dangerous here because the skill is authorized to reshape instructions and potentially patch files, increasing the chance of unintended or overbroad changes to safety-relevant content.

Vague Triggers

Medium
Confidence
89% confidence
Finding
The default prompt uses broad, common phrases like edit, tighten, clean up, and remove slop, which are likely to appear in ordinary user requests outside the intended scope. Combined with implicit invocation, this can cause the skill to activate unexpectedly and steer handling of requests involving unrelated files or workflows.

Vague Triggers

Medium
Confidence
92% confidence
Finding
Enabling implicit invocation without tight trigger constraints increases the chance that this skill will run on loosely related natural-language requests. Because the skill is designed to modify or review agent skills, unintended activation could lead to unrequested changes, misclassification of task intent, or interference with safer routing logic.

Self-Modification

High
Category
Rogue Agent
Content
description: Use when asked to review, edit, tighten, shorten, deduplicate, clean up, or remove slop from an existing agent skill while preserving behavior. Use for skill files that need clearer triggering, shorter instructions, stale reference cleanup, host-compatible frontmatter, or fixes for vague, repetitive, outdated, unsupported, or hard-to-apply rules.
---

# Edit Skill

Use this for existing skill files. The job is to improve agent behavior, not to
make the prose sound nicer.
Confidence
88% confidence
Finding
This skill is explicitly designed to edit existing skill files, which is a self-/peer-modification capability affecting agent behavior and potentially safety boundaries. Although framed as preserving behavior, it can still weaken safeguards, delete important constraints as 'filler,' or normalize risky instruction changes if invoked on security-sensitive skills.

Self-Modification

High
Category
Rogue Agent
Content
interface:
  display_name: "Edit Skill"
  short_description: "Review and tighten existing agent skills while preserving behavior, trigger intent, safety boundaries, and host-compatible frontmatter."
  default_prompt: "When the user asks to edit, tighten, dedupe, clean up, or remove slop from an existing skill, classify review-only vs edit-in-repo, preserve the skill's real job and safety boundaries, cut vague or stale rules, and verify referenced paths or commands before reporting changes."
policy:
Confidence
85% confidence
Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Self-Modification

High
Category
Rogue Agent
Content
OPENAI = ROOT / "agents" / "openai.yaml"

required_sections = [
    "# Edit Skill",
    "## Rules",
    "## Pass Order",
    "## Output",
Confidence
85% confidence
Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Static analysis

No suspicious patterns detected.