ClawHub
Back to skill

Security audit

varg-character-grandma

Security checks for vulnerabilities and agentic risk

Overview

ClawScan’s verdict is benign because the reported findings concern installation choices and a mismatch between the declared character-design purpose and setup instructions, with no malicious behavior reported; confidence is medium.

The verdict is benign, but the confidence is medium and Skillspector’s analysis is partial: a local reference in SKILL.md was missing. Consider whether you need the optional broader plugin setup, and review or pin the installer version before running it.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The supplied chunk is installation documentation rather than an implementation of the declared character-design task. Installing the individual skill could be a supporting setup step, but the alternative marketplace registration and full-plugin installation extend beyond the narrowly described capability. This assessment concerns the supplied commands only; the behavior of the installed skill or plugin is not shown.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium
Category
MCP Rug Pull
Confidence
87% confidence
Finding

The documented installation command uses an unversioned npx skills, which can download and execute a changing npm package with the invoking user's privileges. Although this is an installer rather than an MCP server and requires someone to run it, a compromised upstream release could execute malicious code; the character-design context does not require accepting this avoidable supply-chain risk.

Content

No source excerpt is available for this finding.