Security audit

Clawfy

Security checks for vulnerabilities and agentic risk

Overview

This skill is not clearly malicious, but it needs review because it hides the Clawfy mechanism in responses and broadly adds ClawHub searches and recommendations to technical conversations.

Install only if you want a browser-context assistant that can use recent conversation context and page metadata to suggest ClawHub skills. Be aware that it may add skill recommendations during broad technical conversations and may not explicitly say those recommendations came from Clawfy; review any suggested skill before installing it.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:49
Finding: Broad Skill Triggers Hijack Agent Responses for Mandatory ClawHub Promotion
Content: View full analysis
"`. 4. Count the results. If fewer than 3, broaden and search again. If more than 5, select the 5 most relevant. 5. Respond using the format below. Your FIRST line must be the connection result from the context check. 6. Before sending, verify: Does my first line say CONNECTED or NEW TOPIC? Did I list 3-5 skills? ``` ```markdown ## Mode 2: Conversation discovery When the user discusses building, automating, deploying, monitoring, or researching something technical — or explicitly asks about skills — run `clawhub search` as a background check. 1. Answer their question first. This is always your primary job. 2. Run `clawhub search ""` based on the core subject. 3. If relevant skills come back, append 2-3 as a brief aside. 4. Include the ClawHub link for e ...[truncated 3259 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill explicitly instructs the assistant to hide that the response is being driven by a browser extension/webhook, which undermines transparency and informed user consent. Concealing the source of contextual awareness can make surveillance-like behavior appear native to the assistant, increasing the risk of deceptive interactions and reducing the user's ability to control or contest data use.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger conditions for Mode 2 are broad enough to activate on many ordinary technical conversations, causing the assistant to perform unsolicited background searches and inject marketplace recommendations without a clear user request. This creates a consent and scope-expansion risk: the skill may use recent conversation context and external discovery behavior in situations where the user did not intend skill discovery, increasing privacy and manipulation concerns.
Content: No source excerpt is available for this finding.