Security audit

system-repair-expert

Security checks for vulnerabilities and agentic risk

Overview

This troubleshooting skill is useful in purpose, but it broadly sends and stores diagnostic details without enough scoping, consent, or redaction.

Review this skill before installing in sensitive environments. Avoid pasting secrets, full logs, configuration files, hostnames, tokens, or private paths unless the workflow adds redaction and explicit approval before web searches and memory storage. Treat any recommended third-party skill, GitHub result, or repair command as unverified until you check its source and permissions.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: integration.js:17
Finding: Unredacted Diagnostic Data Is Transmitted to an External Search Provider
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: integration.js:17
Finding: Unverified Search Results Are Labeled as Official and Recommended for Installation
Content: View full analysis
0) { return { step: 2, status: 'official_solutions_found', results: officialResults.results, message: 'Official solutions found - recommend implementing these first' }; } ``` The equivalent Skill-search branch recommends installation and use merely because results exist: ```javascript if (skillResults.results && skillResults.results.length > 0) { return { step: 3, status: 'relevant_skills_found', results: skillResults.results, message: 'Existing skills found - recommend installing and using these' }; } ``` ### Technical Analysis The search query does not establish that a result belongs to the affected product's verified official domain. The generic `site:official-docs` expression is not a product-specific trust control, and the `OR site:github.com` branch permits arbitrary GitHub content to be returned while the result message labels the content as official documentation. The ClawdHub search similarly accepts GitHub-hosted content without validating the publisher, repository ownership ...[truncated 2013 chars]
Remediation: View remediation

T02 · Agent Memory Poisoning

Warning

Location: SKILL.md:24
Finding: Unsanitized Troubleshooting Content May Be Persisted in Long-Term Memory
Content: View full analysis
80%) is found, accelerate subsequent steps - Record the association between this problem and historical cases ``` ```markdown ## Memory system integration - Query: Search historical repair cases, common error patterns, and successful solutions - Store: Save the current repair process and result for future reference - Update: Optimize problem classification and solution recommendations based on this experience - Pattern recognition: Identify recurring problem patterns and provide early warnings ``` ### Technical Analysis The Skill directs the agent to save the current repair process and its result to persistent memory. Troubleshooting sessions may contain user-controlled text, complete errors, logs, configuration fragments, environment details, and recommendations obtained from external search results. No instructions define user consent, memory isolation, retention limits, provenance tracking, sanitization, secret removal, or restrictions against storing raw diagnostic data. There is also no requirement to distinguish verified solutions from untrusted external content. This creates two related risks: - **Confidentiality risk:** Sensitive logs or configuration values may persist across sessions. - **Memory-poisoning risk:** Crafted diagnostic content or unverified repair guidance can become part of the future matching and recommendation state. Because the repository contains instructions rather than the underlying memory implementation, the exact retention scope depends on the host platform. The unsafe behavior is nevertheless explicitly requested ...[truncated 1126 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Note

Location: CLAWDHUB_MANIFEST.json:27
Finding: Manifest Requests Unnecessary Filesystem-Read Capability
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (13)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The manifest describes the skill as a general 'system repair expert' that handles systems, software, configuration, and error issues, which is a very wide problem space. In a manifest file, this lacks explicit invocation boundaries or exclusion conditions, increasing the risk of unintended matching for many ordinary troubleshooting requests.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The description is written as a Chinese-language persona/behavior statement and does not indicate that the user can choose another language. This can violate language or locale policy when a skill appears to impose a specific language without user opt-in or documented justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill documentation is entirely in Chinese and presents the skill as operating in that language, with no indication that users may choose another language or locale. Under the policy rule for natural-language violations, forcing a specific language without user opt-in is in scope.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 71% confidence
Finding: The file presents the skill heading and surrounding usage documentation in Chinese, with no indication that users may choose another language or locale. If the skill is intended for general use, this can conflict with language-choice policy because it implies a fixed language without explicit user opt-in or documented regional justification.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The invocation guidance is very broad: it suggests using the skill whenever users encounter system, software, configuration, or error problems. In an agentic environment, such generic triggering criteria can cause the skill to activate for a large share of common troubleshooting requests, increasing the chance of overreach, unintended tool use, or the skill being selected when a narrower, safer skill would be more appropriate.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 71% confidence
Finding: The title and the entire instruction set are written in Chinese, and there is no statement offering language choice or clarifying that the locale is region-specific. This can amount to a language-policy issue if the skill is expected to serve general users but implicitly forces one language.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger condition activates on very broad 'system/software/config/error repair' requests, which can cause the skill to engage in many ordinary conversations without clear user intent. In this skill's context, broad activation increases the chance that sensitive troubleshooting data is processed, searched externally, or stored in memory when the user did not explicitly opt in.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill states that it will store repair processes and results in a memory system but does not clearly warn users beforehand or obtain consent. Troubleshooting cases often contain logs, configuration snippets, hostnames, usernames, internal paths, tokens, or other sensitive operational data, so silent retention creates a meaningful privacy and data-handling risk.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly instructs the agent to persist user-provided troubleshooting details, repair history, and outcomes into memory for future reuse. Because system repair sessions commonly include confidential environment data and incident context, this persistence can leak sensitive information across sessions or retain data beyond user expectations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: All user-facing instructions and examples in the file are written only in Chinese, with no indication that language selection is optional or that the skill is intended exclusively for a Chinese-speaking context. This can violate language or locale policy when users are not given an explicit opt-in or alternative.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The activation guidance is very broad: it suggests invoking the skill for essentially any system, software, configuration, or error problem. That increases the chance the agent will be selected in contexts far beyond its validated scope, which can lead to inappropriate troubleshooting actions, over-collection of sensitive diagnostic data, or unsafe repair suggestions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file presents the skill title and all example interactions entirely in Chinese, indicating a fixed language/locale expectation. There is no visible user choice, opt-in, or justification that this skill is intended only for a Chinese-speaking or region-specific context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The package description states the skill as a Chinese-language system repair expert ("一个极其严谨的系统修复专家AI") with no indication that users can choose another language or locale. This is a natural-language policy concern because it imposes a language constraint without opt-in or a documented region-specific justification.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.