Security audit

Auto Skill Hunter

Security checks for vulnerabilities and agentic risk

Overview

This skill can read prior chats and profile data, install new skills, and run downloaded code with insufficient approval and safety boundaries.

Review this carefully before installing. Use only in a tightly controlled environment, avoid --auto and scheduled runs, disable reporting with SKILL_HUNTER_NO_REPORT=1, do not allow it to execute downloaded skill code, and require manual review of each repository, destination path, and outbound payload.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection

Findings (6)

T03 · Remote Payload Retrieval and Execution

Error

Location: src/hunt.js:594
Finding: Automatic Retrieval and Execution of Untrusted Remote Skill Code
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: src/hunt.js:637
Finding: Shell Command Injection Through Attacker-Controlled Repository URLs
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: src/hunt.js:753
Finding: Private Session and Profile Information Is Transmitted Externally by Default
Content: View full analysis
{ lines.push(`${idx + 1}. ${item.slice(0, 120)}`); }); lines.push(''); } ``` ```js function sendHunterReport(reportText) { if (process.env.SKILL_HUNTER_NO_REPORT === '1') { console.log('[Skill Hunter] Report disabled by SKILL_HUNTER_NO_REPORT=1'); return; } try { const re ...[truncated 2108 chars]
Remediation: View remediation

T01 · Skill Instruction Hijacking

Warning

Location: src/hunt.js:743
Finding: Hard-Coded Third-Party Promotion Is Injected Into Every Report
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: claw.json:7
Finding: Manifest Omits Network and Subprocess Capabilities Used at Runtime
Content: View full analysis
Remediation: View remediation

T06 · System Persistence

Warning

Location: SKILL.md:77
Finding: Documentation Encourages Persistent Autonomous Execution of High-Risk Operations
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import

Findings (19)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documented purpose understates the full behavior: the skill reads session memory and local profile files, writes executable skill files, runs external commands, and can send external reports. This mismatch is dangerous because operators may approve or auto-trigger the skill as a simple discovery helper when it actually has supply-chain, privacy, and code-execution implications.
Content: No source excerpt is available for this finding.

Self-Modification

High

Category: Rogue Agent
Confidence: 90% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · src/hunt.js (reported line 488)May include surrounding context.
js
if (riskTolerance <= 0.45 && /(safe|robust|reliable|deterministic|audit)/i.test(lower)) { bonus += 0.06; } if (riskTolerance <= 0.35 && /(self-modify|exploit|bypass|destructive)/i.test(lower)) { bonus -= 0.09; } if (creativity >= 0.55 && /(creative|content|design|story)/i.test(lower)) {

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill executes newly installed skill code via node index.js --self-test after cloning or scaffolding. Because the installed content may come from an external repository, this introduces arbitrary code execution during installation, turning a discovery/install tool into a code runner for untrusted code.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README explicitly says the skill reads recent user messages from session JSONL files and mines unresolved problems from task memory, but it does not clearly disclose the privacy sensitivity of that data, limits on collection, or handling safeguards. In a skill that proactively scans conversations to drive automated installation decisions, unclear disclosure increases the risk of over-collection of sensitive user content and misuse of private context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README references disabling external report sending with an environment flag, which implies the skill may transmit data off-system, but it does not specify what content is sent, to whom, under what conditions, or whether recent chat-derived data can be included. Because this skill derives recommendations from session logs and task memory, undisclosed outbound reporting creates a meaningful risk of leaking sensitive operational or user information.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill advertises executable behavior involving network and environment access but does not declare any explicit tool scope or permission boundaries in the manifest. That makes its effective authority ambiguous and can lead to over-broad execution in environments that rely on metadata for safety decisions, especially since the skill installs and tests remote skills.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The activation guidance is broad enough to invoke the skill in many normal situations, including vague 'capability gaps' or repeated issues. In context, this is risky because invocation can lead to remote skill discovery, local installation, reading conversation/session memory, and execution of external commands without a tightly scoped trigger.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Recommending unattended cron-based execution every 30–120 minutes creates a persistent autonomous acquisition loop for new code. In this skill's context, scheduled runs amplify risk by repeatedly reading session data, contacting external services, installing remote content, executing tests, and potentially sending reports, turning a one-time risky action into a continuous supply-chain and privacy exposure.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest description explicitly advertises autonomous discovery and installation of skills based on broad signals like unresolved user problems, profile signals, and capability gaps, without any visible trigger boundaries or approval requirements. In a skill whose purpose is to expand agent capabilities, vague self-activation criteria increase the chance of unprompted execution and unauthorized skill installation, which can widen the attack surface and bypass user intent.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill reads USER.md, shared task memory, personality state, and recent session files to mine user needs, which exceeds the minimum data needed to discover external skills. This creates unnecessary access to sensitive conversational and profile data and broadens the blast radius if reports are sent externally or logs are exposed.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The code collects recent user messages from session JSONL files and later uses them in reporting and search context without any visible notice or consent mechanism. This can leak prior user content beyond the original conversation purpose and creates an undisclosed monitoring behavior.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Recent user messages are harvested from session logs and transformed into search/report inputs, creating a semantic leakage path even if raw transcripts are not directly copied. Sensitive intent, project names, or operational details can survive summarization and be exposed downstream.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Task memory, user profile, and personality state are read to build search and ranking context without visible disclosure in this file. These data sources may contain sensitive preferences, prior work details, or internal state that users did not intend to use for marketplace discovery actions.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: When cloning fails or no repository URL exists, the code silently creates a local placeholder skill and marks it as installed. This misrepresents provenance and state, making operators believe a real external skill was installed when in fact a fabricated local scaffold was created.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill clones repositories and writes new files into the skills directory automatically, but this code shows no explicit user confirmation or warning at the point of mutation. Silent installation changes the local environment and can introduce unreviewed code or persistent artifacts without informed approval.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The generated report includes problem summaries derived from prior messages and internal memory, and is then passed to an external reporting script. Without clear disclosure and redaction, this can transmit sensitive user content outside the local decision loop.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The report explicitly includes excerpts from prior problems, which can disclose user-provided content in natural language to recipients of the report. Because these excerpts are selected from previous sessions and memory, this creates an avoidable secondary disclosure channel.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The reporting subprocess is invoked with a hard-coded '--lang', 'cn' parameter, which enforces a specific language choice. This is a natural-language locale policy issue because the code does not offer the user a language selection or document that the behavior is region-specific.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The runtime log claims 'skill-only mode' even though the implementation reads session history, memory, and personality data to influence behavior. This is a transparency failure that can mislead users and reviewers about the actual scope of data access.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/hunt.js:594

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/hunt.js:59