ClawHub
Back to skill

Security audit

used-car-sentinel

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent offline used-car screening helper with no evidence of hidden access, persistence, network use, or unsafe behavior.

Install if you want an offline helper for screening used-car listings. Treat its pricing and risk outputs as rough guidance, and still use a vehicle-history report, title check, and professional inspection before purchase or deposit.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
80% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · scripts/sentinel.py (reported line 381)May include surrounding context.

python
[ ] Quiet cabin at 80 — wind noise = panel alignment history

AFTER DRIVE (5 min)
[ ] Let it idle: no smoke, temp stable, no warning lights
[ ] Check under car again: new drops after the drive
[ ] A/C cold; heat hot; all windows, locks, wipers, signals
[ ] OBD-II scan if you brought a $20 reader — pending codes tell stories

Static analysis

No suspicious patterns detected.