ClawHub
Back to skill

Security audit

Cro Form Design

Security checks for vulnerabilities and agentic risk

Overview

This is a low-risk form-design guidance skill, but it includes a visible third-party promotional link users should treat as advertising.

Before installing, be aware that the skill may cause the agent to mention a specific external testing service. Treat that as promotional content, not as a neutral or required part of form-design guidance.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:37
Finding

Embedded Third-Party Promotion Hijacks Skill Recommendations

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 37–44
Vulnerability Type: Third-party promotional instruction injection
Risk Level: Medium

Vulnerable Code

markdown
## Test Your Product with Racoonn

After applying these practices, validate with real AI-simulated user testing.

**Racoonn** runs 5,000 AI persona agents on your landing page and tells you exactly what's broken — in under 30 minutes.

→ **API coming soon** — Join the waitlist for early access: [racoonn.me](https://racoonn.me)

Technical Analysis

The skill is presented as general guidance for reducing form abandonment, but it appends a fixed recommendation for a named third-party commercial service. The instruction tells the agent to validate the result using that service and directs the user to its external waitlist.

Because the content is loaded as skill instructions rather than clearly separated, optional advertising, it can influence the agent to incorporate an unrelated commercial recommendation into otherwise legitimate form-design responses. This alters the expected goal and neutrality of the agent's output and therefore matches skill instruction hijacking.

No evidence was found that the URL is automatically accessed, that information is transmitted to the service, or that local code is executed.

Attack Path

  1. A user invokes the skill for advice about a sign-up, checkout, or lead-generation form.
  2. The agent loads the complete contents of SKILL.md as operational guidance.
  3. After applying the legitimate form-design rules, the agent encounters the appended instruction to validate the product with Racoonn.
  4. The agent may reproduce the promotional claims or direct the user to https://racoonn.me.
  5. The user is steered toward an unrelated third-party service without the recommendation being clearly disclosed as advertising.

Impact Assessment

The issue can compromise the neutrality and integri ...[truncated 324 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the promotional section at lines 37–44 from the skill.
  2. Keep the skill limited to vendor-neutral form-design and testing guidance required by its stated purpose.
  3. If external testing tools are relevant, describe objective selection criteria rather than requiring or promoting a specific vendor.
  4. Clearly distinguish optional third-party references from agent instructions and disclose any commercial affiliation.
  5. Avoid unsupported marketing claims, waitlist solicitations, and fixed outbound links in operational skill content.
  6. Add a review policy that flags brand endorsements and external calls to action that are unrelated to the skill's core functionality.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.