ClawHub
Back to skill

Security audit

Session Debug Log Investigator

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward debug-log troubleshooting helper, with a privacy caveat because debug logs can contain sensitive details.

Install only if you want an agent to inspect recent session debug logs and related settings. Avoid sharing raw logs broadly, and redact secrets, personal data, tokens, paths, and prompt contents when possible.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill explicitly tells the agent to enable debug logging but does not warn that debug logs may capture sensitive information such as prompts, paths, tokens, environment details, or user data. Because the skill also encourages reading and summarizing recent logs, it can lead to unnecessary collection and exposure of sensitive data during troubleshooting.

Vague Triggers

Medium
Confidence
89% confidence
Finding
The example request "Help me understand why this Claude Code session is misbehaving" is broad conversational language and could overlap with many ordinary troubleshooting requests. The file does not provide tighter activation constraints or exclusion conditions to clarify when this specific skill should be invoked instead of more general debugging help.

Static analysis

No suspicious patterns detected.