ClawHub
Back to skill

Security audit

ladder-safety-planner

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent offline ladder-safety planning aid with disclosed safety limits and no evidence of hidden access, persistence, or data exfiltration.

Before installing, treat this as a homeowner planning aid rather than professional safety certification. Its local Python helper appears offline and narrowly scoped, but ladder and electrical work can still be dangerous; follow local rules, manufacturer labels, and hire a professional when the setup is marginal.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Harmful Content Injection

Critical
Category
Prompt Injection
Confidence
95% confidence
Finding

This content may contain harmful instructions that could cause physical harm if followed. CRITICAL: Review carefully before use.

Content

Scanner excerpt · references/ladder-engineering.md (reported line 79)May include surrounding context.

md
## 6. Overhead lines

- Minimum approach: **10 ft for lines up to 50 kV**, plus 4 inches per kV
  above 50 kV (OSHA-style clearances; utilities may require more).
- Aluminum ladders: never within clearance of any line, period.
- Residential service drops (120/240 V) kill people every year — treat
  unknown voltage as high; wet wooden ladders and contaminated fiberglass
  also conduct.
- Remember the ladder while CARRYING it upright — a surprising share of
  line contacts happen during repositioning.
- If work intrudes on clearance, the utility re-routes/shields or the job

Static analysis

No suspicious patterns detected.