ClawHub
Back to skill

Security audit

Lobster Coordinator

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent multi-agent coordinator, but it gives delegated agents broad authority with unclear activation and permission boundaries.

Install only if you intentionally want autonomous multi-agent orchestration. Before using it, require explicit approval before entering Coordinator or Swarm mode, keep each worker's tool list narrow, ensure deny rules apply to child agents, monitor background sessions, and avoid sensitive data unless scratchpad retention and access are controlled.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The skill description says it will auto-activate when tasks become complex, but it does not define strict activation boundaries or require explicit user opt-in. In a coordinator skill with powers to spawn subagents and exchange messages, vague activation criteria can cause unexpected delegation, broader tool use, and unintended execution paths during ordinary requests.

Static analysis

No suspicious patterns detected.