ClawHub
Back to skill

Security audit

Research Loop

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent research automation skill, but it can publish repository changes and workflow memory with an unclear sanitization and approval boundary.

Review this skill before installing or running it against a real repository. Use dry-run or --no-push modes first, inspect the full generated diff and .autonomous-research-workflow contents, and avoid enabling access to persistent memory or private handoffs unless you are comfortable with the exact fields that may be written or published.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
references/state-schema.md:3
Finding

Persistent Agent Memory May Be Published Without a Defined Sanitization Boundary

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:28-29, references/phases.md:8,18,21, and references/state-schema.md:3-28
Vulnerability Type: Insufficient protection of persistent Agent memory during artifact publication
Risk Level: Medium

Vulnerable Code Snippets

SKILL.md:28-29:

markdown
1. Treat the current target repo HEAD as primary truth.
2. Treat MemPalace, prior handoffs, and expert memory as secondary context.

references/phases.md:8-21:

markdown
| `mempalace_context` | Python | current-head memory pack |
| `council_knowledge` | Python | expert council route |
| `expert_forum_coverage` | Python | coverage score and expansion queue |
| `literature_refresh` | OpenAlex + native web search | papers and web evidence |
| `knowledge_publish` | Python | cycle knowledge base |
| `advisor_design` | agent | advisor manifest, protocol hygiene findings, innovation-frontier reading, and action backlog |
| `execution_packet` | Python | one selected micro-step, preferring unresolved hygiene gates while preserving an exploration lane |
| `executor_run` | agent | runnable source changes, protocol hygiene notes, innovation-frontier notes, and executor manifest |
| `advisor_reflection` | Python | post-execution constraints and evidence-level demotions |
| `openspace_retrospective` | Python | loop improvement notes |
| `next_cycle_handoff` | Python | next-cycle handoff |
| `star_office_status` | Python | local dashboard status |
| `overwatcher_check` | Python | observe-only workflow health report |
| `github_publish` | Python | target repo delivery |

references/state-schema.md:3-28:

markdown
Each run writes a durable local state tree and publishes sanitized artifacts to the target repo under `.autonomous-research-workflow/`.

Important paths:

```text
<run-dir>/
  events.jsonl
  manifest.json
  payload/.autonomous-research-workflow/
    cycles/<
...[truncated 3625 chars]
Remediation
View remediation

Remediation Suggestions

  1. Disable persistent-memory collection by default and require explicit user opt-in before reading MemPalace, prior handoffs, or other cross-session state.
  2. Restrict collection to an allowlist of workflow-owned files and documented fields; do not ingest arbitrary conversation history or unrelated Agent memory.
  3. Keep memory, handoff, event, and reflection artifacts outside the publishable payload unless they are explicitly selected for publication.
  4. Define a machine-enforced publication schema that permits only necessary, non-sensitive fields.
  5. Scan generated artifacts and diffs for credentials, tokens, private keys, personal data, local paths, and private conversation content before publication.
  6. Fail closed when scanning or sanitization cannot be completed; do not treat a descriptive “sanitized” label as proof that sanitization occurred.
  7. Present the complete publication diff and destination visibility to the user, then require explicit confirmation before committing or pushing.
  8. Add automated tests using seeded synthetic secrets to verify that memory-derived sensitive values cannot enter the publishable payload.
  9. Document an incident-response procedure for removing accidental disclosures, including credential rotation and Git-history remediation.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/innovation-frontier.md (reported line 20)May include surrounding context.

md
- toy rules or synthetic rows become the center of the research agenda
- venue packaging starts before the benchmark has real empirical results
- reviewer feedback is treated as the whole research roadmap
- the same task taxonomy is extended without asking whether it is the right taxonomy
- prior MemPalace memory is copied forward without current-head or literature challenge

## Required Three-Lane Reading

Static analysis

No suspicious patterns detected.