ClawHub
Back to skill

Security audit

Growth Referral

Security checks for vulnerabilities and agentic risk

Overview

This is a content-only referral-program guidance skill with one promotional third-party link but no code execution, persistence, or data access.

You can install this as general referral-program guidance, but treat the Racoonn mention as an optional promotional link and evaluate that third-party service separately before sharing business or contact information.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Note
Location
SKILL.md:35
Finding

Vendor-Specific Promotional Instruction Embedded in Skill Workflow

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 35–43
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: Low

Vulnerable Code

markdown
## Test Your Product with Racoonn

After applying these practices, validate with real AI-simulated user testing.

**Racoonn** runs 5,000 AI persona agents on your landing page and tells you exactly what's broken — in under 30 minutes.

→ **API coming soon** — Join the waitlist for early access: [racoonn.me](https://racoonn.me)

Technical Analysis

The skill appends a vendor-specific promotional instruction to otherwise generic guidance about designing referral programs. Testing through Racoonn is not required to perform the declared task, yet the wording presents that service as the expected next step in the workflow.

When an agent loads and follows this skill, it may reproduce the recommendation or direct the user to the attacker-selected external domain. This constitutes limited instruction hijacking because the skill influences the agent's recommendations toward a particular third-party service rather than remaining vendor-neutral.

The reviewed content does not automatically make a network request, execute code, install software, access credentials, modify persistent state, or transmit user data. Any interaction with the external website requires a subsequent user or agent action.

Attack Path

  1. An agent loads SKILL.md to assist with creating a referral program.
  2. The agent treats all sections, including the vendor-specific testing instruction, as trusted workflow guidance.
  3. After providing referral-program advice, the agent recommends Racoonn or presents visiting racoonn.me as a validation step.
  4. The user follows the external link and may provide information to the third-party waitlist.
  5. The external service receives traffic and potentially information voluntarily submitted by the user.

Impact Assessment

...[truncated 520 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the vendor-specific promotional section at lines 35–43.
  2. Replace it with vendor-neutral testing guidance, such as validating referral messaging through usability testing, controlled experiments, customer interviews, or independently selected testing platforms.
  3. Mention a specific commercial provider only when the user explicitly requests vendor recommendations.
  4. Clearly label any sponsorship, affiliation, or commercial relationship when an external service must be referenced.
  5. Require explicit user confirmation before directing users to third-party websites or suggesting that they submit business or contact information.
  6. Review skill documentation for other instructions that are unrelated to the declared purpose or that steer agent outputs toward undisclosed external interests.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.