T09 · Insecure Skill Coding Practices
Error
- Location
scripts/validate-collab-payload.py:16- Finding
Sensitive credential values are exposed in validation and CI logs
- Content
View full analysis
- Remediation
View remediation
Security audit
ClawColab
Security checks for vulnerabilities and agentic risk
Overview
The skill is purpose-aligned but should be reviewed because its bundled CI and approval templates can weaken the secrecy and approval safeguards it is meant to provide.
Review and harden this skill before using it in a shared repository: redact secret-scan output before running it in CI, change decision templates to pending or draft by default, pin GitHub Actions to reviewed SHAs, set explicit read-only workflow permissions, disable checkout credential persistence, and only scan user-selected collaboration paths.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
assets/github-workflows/clawcolab-validate.yml:3- Finding
Pull requests execute contributor-controlled repository scripts
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
assets/github-workflows/clawcolab-validate.yml:11- Finding
GitHub Actions dependencies are referenced through mutable version tags
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
assets/decision-template.md:6- Finding
Approval record templates default to an already-approved state
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill claims to coordinate secure collaboration, but it also references local file-content scanning and validation behavior that reads local files directly without clearly advertising that capability. In this context, hidden read behavior is especially sensitive because the skill's own mission involves secrecy boundaries and private local context; undisclosed reads undermine those assurances and may expose confidential material during validation or summarization.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill claims to coordinate secure collaboration, but it also references local file-content scanning and validation behavior that reads local files directly without clearly advertising that capability. In this context, hidden read behavior is especially sensitive because the skill's own mission involves secrecy boundaries and private local context; undisclosed reads undermine those assurances and may expose confidential material during validation or summarization.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill text instructs the agent to read and write local repository artifacts and to invoke bundled scripts, but it does not declare any explicit tool scope or permissions boundary. In a half-trust collaboration setting, undeclared file access is risky because users may not realize the skill can touch local files or repository state, increasing the chance of unintended disclosure or modification.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md 2. **Default to non-sharing** 3. **Share the minimum necessary** 4. **Treat local memory and secrets as private by default** 5. **Do not promote visibility levels without approval** 6. **Record decisions and approvals explicitly** 7. **Prefer structured artifacts over freeform chat**
Static analysis
No suspicious patterns detected.