ClawHub
Back to skill

Security audit

Clear Writing

Security checks for vulnerabilities and agentic risk

Overview

This is a writing-guidance skill made of Markdown references, with no runtime code, but its README uses unpinned npx install commands users should treat carefully.

Review the README install commands before using them, especially the unpinned npx and @latest forms. Prefer a pinned ClawHub version or a reviewed local install path, and apply your own inclusive-language and house-style rules when the historical Strunk references conflict with modern guidance.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:31
Finding

Unpinned Remote Packages Are Executed During Installation

Content
View full analysis
Remediation
View remediation
install clear-writing ``` 2. Replace mutable GitHub branch paths with an immutable commit reference or a versioned release artifact. 3. Publish checksums or cryptographic signatures for release artifacts and document how users should verify them before installation. 4. Prefer installation from a reviewed local archive for this documentation-only Skill, avoiding execution of downloaded package code where possible. 5. Clearly warn users that `npx` downloads and executes third-party code. 6. In automated environments, use a lockfile, an approved internal package mirror, and package allowlisting. 7. Run installation in a sandbox or container with minimal filesystem access, no unnecessary credentials, and restricted outbound network access. ]]>

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (13)

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/signs-of-ai-writing.md (reported line 165)May include surrounding context.

md
> The future of hydrocarbon economies faces several challenges, including[...] This section would speculate on potential developments and the changing landscape of global energy.

> Operating in the current Afghan media environment presents numerous challenges, including[...] Despite these challenges, Amu TV has managed to continue to provide a vital service to the Afghan population​​.

> For example, while the methodology supports transdisciplinary collaboration in principle, applying it effectively in large, heterogeneous teams can be challenging. [...] SCE continues to evolve in response to these challenges.

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/signs-of-ai-writing.md (reported line 465)May include surrounding context.

md
**Words to watch:** *I hope this helps*, *Of course!*, *Certainly!*, *You're absolutely right!*, *Would you like...*, *is there anything else*, *let me know*, *more detailed breakdown*, *here is a*...

Editors sometimes paste text from an AI chatbot that was meant as correspondence, prewriting or advice, rather than article content. This may appear in article text or within comments (`<!-- -->`). Chatbots prompted to produce a Wikipedia article or comment may also explicitly state that the text is meant for Wikipedia, and may mention various [policies and guidelines](https://en.wikipedia.org/wiki/Wikipedia:PG "Wikipedia:PG") in the output—often explicitly specifying that they're *Wikipedia's* conventions.

**Examples**

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 3)May include surrounding context.

md
# Clear Writing

Write clear, concise prose for humans — documentation, READMEs, API docs, commit messages, error messages, UI text, reports, and explanations. Combines Strunk's rules for clearer prose with technical documentation patterns, structure templates, and review checklists.

## What's Inside

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The README instructs users to execute npx add against a remote GitHub source without pinning to a specific immutable version or commit. This creates a supply-chain risk: if the upstream repository changes or is compromised, users may install unexpected or malicious content when following the documented command.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The command npx clawhub@latest install clear-writing uses the floating latest tag, which can resolve to different code over time. If the package publisher account or distribution path is compromised, users following the README could execute attacker-controlled code.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 63)May include surrounding context.

From your project root:

bash
mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/writing/clear-writing .claude/skills/clear-writing

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 70)May include surrounding context.

Claude Code (global)

bash
mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/writing/clear-writing ~/.claude/skills/clear-writing

External Model or Provider Selection

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: clear-writing
model: standard
version: 1.0.0
description: >
  Write clear, concise prose for humans — documentation, READMEs, API docs, commit messages,

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The 'When to Use' section says to use the skill whenever writing prose for humans and reinforces this with 'If you're writing sentences for a human to read, use this skill.' This is an extremely broad trigger scope with no exclusions or limiting context, which can cause unintended invocation across many ordinary tasks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The passage explicitly instructs writers to use masculine pronouns as the default for indefinite antecedents, which can cause the skill to generate exclusionary or policy-noncompliant language without user opt-in. In a writing-assistance skill, prescriptive guidance is especially likely to be surfaced directly in outputs, making this more operationally significant than if it were merely historical reference material hidden from generation.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

This README is a markdown file, so vague-trigger review applies. The phrase 'any explanation' is especially broad and does not define constraints or exclusion conditions, which could cause the skill to activate for generic requests outside its intended technical-writing context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

Line L013 states that the possessive form follows the usage of the United States Government Printing Office and Oxford University Press, presenting a specific locale/style authority as the default. Because this is a style guidance document rather than a clearly justified region-specific compliance tool, the instruction can be read as privileging a particular language convention without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
74% confidence
Finding

Line L035 says the comma usage is also that of the Government Printing Office and Oxford University Press, reinforcing a particular institutional standard as the norm. Without an opt-in or scope statement, this may violate language/locale policy expectations for neutrality across English variants and style guides.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.