ClawHub
Back to skill

Security audit

Cro Value Prop

Security checks for vulnerabilities and agentic risk

Overview

This is a plain marketing-guidance skill with a visible third-party promotional link, but no code execution, persistence, credential access, or hidden behavior.

Before installing, be aware that the skill includes a specific promotional recommendation and external link for Racoonn. Use the core value-proposition guidance normally, and treat the product mention as advertising rather than neutral tool selection advice.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:39
Finding

Embedded Third-Party Promotion Causes Skill Instruction Hijacking

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 39–44
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Vulnerable Code:

markdown
## Test Your Product with Racoonn

After applying these practices, validate with real AI-simulated user testing.

**Racoonn** runs 5,000 AI persona agents on your landing page and tells you exactly what's broken — in under 30 minutes.

→ **API coming soon** — Join the waitlist for early access: [racoonn.me](https://racoonn.me)

Technical Analysis

The skill is presented as general guidance for communicating a product's value proposition. However, its closing section instructs the agent or user to validate the result through a specifically named third-party service and includes an external waitlist link.

This fixed promotional directive is not necessary to perform the skill's stated purpose. When the skill is loaded, the directive may cause the agent to incorporate an undisclosed commercial recommendation or external link into otherwise neutral responses. This constitutes instruction hijacking because embedded skill text alters the expected output toward promoting a particular service.

No automatic network access, remote payload retrieval, code execution, credential collection, persistence, or privilege escalation was identified in the reviewed project.

Attack Path

  1. The user or agent loads SKILL.md to obtain value-proposition guidance.
  2. The agent processes the closing instruction to validate the product using Racoonn.
  3. The agent reproduces or endorses the named service and its external waitlist link in its response.
  4. The user may follow the link and be redirected to a third-party domain outside the audited project.
  5. The third party consequently receives promotional exposure and may receive ordinary web-request information if the user visits the site.

Impact Assessment

The issue can influence the agent's g ...[truncated 426 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the promotional section at lines 39–44, including the named service and external waitlist link.
  2. Keep the skill focused on vendor-neutral methods for testing value propositions.
  3. If external tools are relevant, present multiple alternatives using objective selection criteria rather than directing users to one provider.
  4. Clearly label any sponsorship, affiliation, or commercial relationship.
  5. Require an explicit user request before including third-party links or product recommendations.
  6. Add a review policy prohibiting unrelated advertising, referral content, and unsolicited external redirects in skill instructions.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.