ClawHub
Back to skill

Security audit

Sift

Security checks for vulnerabilities and agentic risk

Overview

Sift is an instruction-only governance skill that asks an agent to check a third-party authorization service before consequential actions; it is coherent, but users should not treat it as a hard enforcement boundary by itself.

Install this only if you intentionally want a Sift account and third-party authorization checks before consequential agent actions. Treat the skill as best-effort prompt-layer governance unless you also use a platform-level plugin, keep the private signing key out of chat and logs, and avoid sending secrets or unnecessary sensitive details in authorization parameters.

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
The skill presents itself as mandatory, fail-closed, and effectively deterministic, but later admits the skill-only approach depends on the agent voluntarily following instructions and is therefore bypassable. This mismatch can cause operators to rely on the skill as an enforcement boundary when it is only advisory, creating a dangerous false sense of security around high-risk actions.

Description-Behavior Mismatch

Medium
Confidence
98% confidence
Finding
The manifest description claims the skill 'authorizes actions before executing them,' 'issues a signed receipt for ALLOW decisions,' and 'blocks on DENY,' but the file only instructs the model to call an external service. Because the skill cannot itself interpose on tool execution, these claims overstate the security properties and may lead adopters to believe actions are technically blocked when the agent can simply omit the check.

Static analysis

No suspicious patterns detected.