ClawHub
Back to skill

Security audit

Brainstorming

Security checks for vulnerabilities and agentic risk

Overview

This planning skill is not malicious, but it can force a broad workflow and tell agents to create and commit files without a clear opt-in.

Install this only if you want a strict design-first workflow. Before using it, ensure your agent still follows current user instructions and asks separately before writing files or creating git commits.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:14
Finding

Mandatory Agent Workflow and Skill-Routing Hijacking

Content
View full analysis
Do NOT invoke any implementation skill, write any code, scaffold any project, or take any implementation action until you have presented a design and the user has approved it. This applies to EVERY project regardless of perceived simplicity. ``` `SKILL.md:24-31`: ```markdown You MUST create a task for each of these items and complete them in order: 1. **Explore project context** — check files, docs, recent commits 2. **Ask clarifying questions** — one at a time, understand purpose/constraints/success criteria 3. **Propose 2-3 approaches** — with trade-offs and your recommendation 4. **Present design** — in sections scaled to their complexity, get user approval after each section 5. **Write design doc** — save to `docs/plans/YYYY-MM-DD--design.md` and commit 6. **Transition to implementation** — invoke writing-plans skill to create implementation plan ``` `SKILL.md:52-53`: ```markdown **The terminal state is invoking writing-plans.** Do NOT invoke frontend-design, mcp-builder, or any other implementation skill. The ONLY skill you invoke after brainstorming is writing-plans. ``` `SKILL.md:88-90`: ```markdown **Implementation:** - Invoke the writing-plans skill to create a detailed implementation plan - Do NOT invoke any other skill. writing-plans is the next step. ``` ### Technical Analysis The skill text uses unconditional priority directives such as `MUST`, `HARD-GATE`, `Do NOT`, and `ONLY` to take control of the agent's workflow whenever the skill i ...[truncated 3051 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Vague Triggers

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill description says it 'MUST use this before any creative work,' which is an overly broad mandatory trigger that can cause the agent to invoke this skill in many unrelated situations. In practice, this can override user intent, force unnecessary workflow steps, and increase the chance of unintended repository access or follow-on actions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md
## Checklist

You MUST create a task for each of these items and complete them in order:

1. **Explore project context** — check files, docs, recent commits
2. **Ask clarifying questions** — one at a time, understand purpose/constraints/success criteria

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The checklist instructs the agent to write a design document to the repository and commit it, but does not require explicit user consent before modifying files or git history. That creates a risk of unauthorized repository changes from a planning-only skill, especially when combined with the skill's mandatory invocation language.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The later documentation repeats instructions to save a design document and commit it to git, again without a consent gate or warning. Repetition strengthens the directive and makes it more likely an agent will treat repository modification as mandatory default behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.