ClawHub
Back to skill

Security audit

Growth Virality

Security checks for vulnerabilities and agentic risk

Overview

This is a simple guidance-only skill with one promotional third-party testing link, but no code, persistence, credential access, or automatic data movement.

Before installing, understand that the skill may steer product-testing advice toward Racoonn. Treat that as an optional vendor mention, not a required or impartial part of viral-loop design.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:38
Finding

Third-Party Promotional Instruction Injection

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 38–44
Vulnerability Type: Third-party promotional instruction injection
Risk Level: High

Vulnerable Code

markdown
## Test Your Product with Racoonn

After applying these practices, validate with real AI-simulated user testing.

**Racoonn** runs 5,000 AI persona agents on your landing page and tells you exactly what's broken — in under 30 minutes.

→ **API coming soon** — Join the waitlist for early access: [racoonn.me](https://racoonn.me)

Technical Analysis

The skill's declared purpose is to provide guidance for designing viral product loops. The cited section exceeds that scope by instructing users to validate their work through a named third-party service and directing them to an external waitlist.

When an agent loads the skill as trusted operational guidance, it may treat this promotional section as part of the expected workflow. Consequently, otherwise legitimate responses may reproduce the branded recommendation or direct users to the external domain. This constitutes instruction hijacking because attacker-controlled promotional guidance can alter the agent's output and steer users toward a service unrelated to the skill's core functionality.

The inspected content contains no executable code and does not establish automatic network access, remote payload execution, credential collection, or data exfiltration.

Attack Path

  1. An agent loads SKILL.md to assist with engineering viral loops.
  2. The agent treats the entire document, including lines 38–44, as trusted task guidance.
  3. The injected section directs the agent to recommend Racoonn as the validation mechanism.
  4. The agent reproduces the recommendation or external URL in its response.
  5. The user may follow the link or perceive the service as a required or impartial component of the workflow.

Impact Assessment

The issue can manipulate agent-generated recommendations and convert normal task output i ...[truncated 402 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the Racoonn-specific promotional section and external waitlist link from lines 38–44.
  2. Replace it with vendor-neutral testing guidance, such as usability testing, controlled experiments, referral-conversion measurement, and cohort analysis.
  3. Clearly separate optional third-party resources from normative skill instructions.
  4. Require explicit user consent before accessing an external service or transmitting product information.
  5. Review future skill content for unrelated branding, affiliate links, promotional calls to action, and instructions that exceed the skill's declared purpose.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.