ClawHub
Back to skill

Security audit

Group Debug & Deploy Expert

Security checks for vulnerabilities and agentic risk

Overview

This skill is a broad DevOps automation guide whose main purpose is coherent, but it asks agents to perform high-impact operations, keep durable state, and handle secrets in ways that need careful review before installation.

Install only if you want a very broad DevOps/debugging skill with command execution and file modification authority. Before use, keep it away from production credentials unless your agent platform enforces secret redaction, require approval for remote commands, service changes, firewall changes, deletions, and rollbacks, and do not treat its .trae/state checkpoints as trusted facts without re-checking them.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Findings (6)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:100
Finding

Skill-Defined Constitutional Authority Can Hijack Agent Instructions

Content
View full analysis
TIER 1 > TIER 2 You operate under 21 immutable iron principles that govern every action, decision, and conclusion. ``` ### Technical Analysis The Skill attempts to establish its own immutable governance hierarchy and directs the Agent to execute according to Skill-authored rules. A Skill may define task-specific procedures, but it must not represent its instructions as constitutional, supreme, or immune from modification and review. These directives can alter the Agent's current-session decision process when the Skill is loaded. In particular, the language can cause the Agent to treat Skill content as having authority beyond ordinary task guidance and resist later correction. The referenced higher-tier files are also absent from the audited package, meaning the claimed authority chain cannot be independently inspected. This is an instruction-hijacking issue because the affected target is the Agent's active goals and safety constraints rather than an application code path. ### Attack Path 1. A user or platform loads the Skill for a debugging or deployment task. 2. The Agent reads the “constitutional” protection notice and governance hierarchy. 3. The Skill instructs the Agent to treat its rules as immutable and mandatory. 4. A subsequent user instruction conflicts with a Skill-authored operational rule. 5. The Agent may ...[truncated 757 chars]
Remediation
View remediation

T02 · Agent Memory Poisoning

Error
Location
SKILL.md:3021
Finding

Persistent Checkpoints Are Reintroduced as Unquestionable Absolute Truth

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:2481
Finding

Sensitive Credentials Are Designated for Permanent Agent Memory Without Defined Protection

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:2543
Finding

Generic Remote and Privileged Operations Exceed Least-Privilege Boundaries

Content
View full analysis
Remediation
View remediation

T06 · System Persistence

Warning
Location
SKILL.md:2547
Finding

Boot-Time Service Enablement Introduces Unnecessary Cross-Session Persistence

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:1507
Finding

Destructive Rollback and Cleanup Commands Can Remove Uncommitted Work and Dependency Integrity Controls

Content
View full analysis
... → Verify: git diff --name-only returns empty → Verify: git status shows clean working tree LEVEL 3 ROLLBACK (environment restore): → Revert dependency changes: git checkout pom.xml / package.json / build.gradle.kts → Clean build artifacts: rm -rf target/ dist/ build/ node_modules/ → Reinstall from lock files: npm install / mvn dependency:resolve → Restore .env files from backup ``` ### Technical Analysis The rollback workflow includes destructive file restoration and recursive deletion. These operations may be appropriate when exact paths and ownership are verified, but the documented process has several unsafe properties: - `git checkout --` irreversibly discards uncommitted modifications. - The verification goal of a completely clean working tree may encourage deletion of unrelated user work. - Recursive deletion depends on the current working directory and shell expansion. - The workflow assumes backups are trustworthy and current. - Restoring `.env` files can reintroduce stale or exposed credentials. - `npm install` may modify a lock file or resolve versions differently from a deterministic clean installation. - No mandatory human confirmation is attached to the destructive rollback levels shown. - No path-containment check prevents execution in the wrong repository. These risks become more severe when combined with persistent-state poisoning or incorrect project selection. ### Attack Path 1. The Agent enters the anti-loop rollback workflow after failed debugging attempts. 2. The working directory contains unrelated or valuable uncommitted changes. 3. A checkpoint, path error, or incorrect project context identifies files for rollbac ...[truncated 879 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (34)

Vague Triggers

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The invocation scope is extremely broad—covering debugging, deployment, CI/CD, testing, ops, security, and multi-project work—which makes accidental over-invocation and privilege misuse much more likely. Because the skill also requests execution and file-write capabilities, broad triggering materially expands the attack surface and can cause the agent to take powerful actions in contexts where a narrower skill should have been used.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
92% confidence
Finding

The skill explicitly instructs checking environment variables and .env-style runtime configuration as part of debugging patterns. In a powerful agent with terminal/file access, guidance to inspect environment state can expose secrets such as API keys, database credentials, or tokens, especially because the skill also promotes extensive logging and archival of evidence.

Content

Scanner excerpt · SKILL.md (reported line 1040)May include surrounding context.

md
│     │  due to cert mismatch)    │ profile, entitlements             │
├────┼────────────────────────────┼───────────────────────────────────┤
│ RC16 │ ENVIRONMENT VARIABLE MISSING│ Critical env var not set in      │
│     │ (.env missing in runtime  │ runtime env but present in code?   │
│     │  environment)             │ env | grep VAR_NAME               │
├────┼────────────────────────────┼───────────────────────────────────┤
│ RC17 │ LOG LEVEL MISCONFIGURATION│ Log level set too high (hiding    │

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
96% confidence
Finding

The skill prescribes rm -rf target/ dist/ build/ node_modules/ as part of an environment rollback. In a skill with terminal.execute and broad invocation scope, destructive recursive deletion commands are dangerous because path mistakes, unexpected working directories, or command generalization could erase important project state or disrupt active environments.

Content

Scanner excerpt · SKILL.md (reported line 1529)May include surrounding context.

md
LEVEL 3 ROLLBACK (environment restore):
    → Revert dependency changes: git checkout pom.xml / package.json / build.gradle.kts
    → Clean build artifacts: rm -rf target/ dist/ build/ node_modules/
    → Reinstall from lock files: npm install / mvn dependency:resolve
    → Restore .env files from backup
    → Verify: Environment matches baseline (version checks, port checks)

Credential Access

High
Category
Privilege Escalation
Confidence
93% confidence
Finding

The rollback procedure includes restoring .env files from backup, implying the skill may read, copy, and preserve credential-bearing configuration. Combined with its persistent archive/checkpoint system, this creates a concrete risk of credential retention, duplication, and unintended disclosure across sessions or projects.

Content

Scanner excerpt · SKILL.md (reported line 1531)May include surrounding context.

md
→ Revert dependency changes: git checkout pom.xml / package.json / build.gradle.kts
    → Clean build artifacts: rm -rf target/ dist/ build/ node_modules/
    → Reinstall from lock files: npm install / mvn dependency:resolve
    → Restore .env files from backup
    → Verify: Environment matches baseline (version checks, port checks)
    → Document: "Full environment rollback due to [loop_pattern]"
    → Proceed to PHASE 3.

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

The frontend diagnostic flow tells the agent to enumerate .env* files during troubleshooting. Even listing and inspecting these files in a broad debug skill increases the chance of exposing sensitive configuration to logs, model context, or persistent state, especially given the skill's archive-heavy design.

Content

Scanner excerpt · SKILL.md (reported line 2697)May include surrounding context.

md
→ npm cache clean --force
                            → rm -rf node_modules package-lock.json && npm install
Build fails               → npm run build 2>&1 | tail -30
                            → Check .env files present: ls -la .env*
                            → Check import errors: grep -r "from 'missing-module'" src/
CORS error                → Check browser Network tab: response headers
                            → Dev: verify nginx proxy_pass config

YARA rule 'offensive_tool_references': References to well-known offensive security tools [hacktools]

High
Category
YARA Match
Confidence
70% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 2716)May include surrounding context.

� npx lighthouse http://localhost:5173 --output json → Check bundle size: du -sh dist/assets/* → Check lazy loading: grep -r "lazy|Suspense" src/

text

---

### R10 Security Real Toolchain

| Tool | Purpose | Verify Available | Key Commands |
|------|---------|-----------------|--------------|
| nmap | Port scanning | `nmap --version` | `nmap -sT -p 1-65535 host`, `nmap -sV host` |
| openssl | TLS check | `openssl version` | `openssl s_client -connect host:443 -servername name 2>&1`, `openssl x509 -noout -dates -in cert.pem` |
| ssh-audit | SSH hardening | `ssh-audit --version` | `ssh-audit host` |
| fail2ban-client | Intrusion prevention | `fail2ban-client status` | `fail2ban-client status sshd`, `fail2ban-client set sshd unbanip ip` |
| grep | Sensitive data scan | `grep --version` | `grep -rn "password\|secret\|apikey" --include="*.yml" --include="*.properties" --include="*.env" .` |
| jq | JSON key scan | `jq --version` |

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

The skill's security workflow includes grepping .env files and other configs for secrets. In a human-operated security review this can be legitimate, but in this autonomous, persistent, multi-function skill it materially increases the chance that secrets are surfaced into transcripts, evidence stores, or handoff artifacts where they do not belong.

Content

Scanner excerpt · SKILL.md (reported line 2720)May include surrounding context.

md
| openssl | TLS check | `openssl version` | `openssl s_client -connect host:443 -servername name 2>&1`, `openssl x509 -noout -dates -in cert.pem` |
| ssh-audit | SSH hardening | `ssh-audit --version` | `ssh-audit host` |
| fail2ban-client | Intrusion prevention | `fail2ban-client status` | `fail2ban-client status sshd`, `fail2ban-client set sshd unbanip ip` |
| grep | Sensitive data scan | `grep --version` | `grep -rn "password\|secret\|apikey" --include="*.yml" --include="*.properties" --include="*.env" .` |
| jq | JSON key scan | `jq --version` | `find . -name "*.json" -exec jq 'keys' {} \;` |

**Security Diagnostic Flow (Real Commands Only)**:

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

This line again directs recursive secret scanning including .env and JavaScript files, which can surface production credentials, access keys, and tokens. The risk is heightened by the skill's stated capabilities for persistent evidence capture and cross-session archival.

Content

Scanner excerpt · SKILL.md (reported line 2730)May include surrounding context.

md
→ firewall-cmd --list-ports
Weak TLS                → openssl s_client -connect host:443 2>&1 | grep "Protocol\|Cipher"
                           → nmap --script ssl-enum-ciphers -p 443 host
Hardcoded secrets       → grep -rn "password\|secret\|apikey\|AK\|SK" --include="*.yml" --include="*.properties" --include="*.env" --include="*.js" project-dir/ | grep -v ".example\|node_modules\|target"
Cert expiry check       → for f in $(find . -name "*.pem" -o -name "*.crt"); do echo "=== $f ===" && openssl x509 -noout -dates -in "$f"; done
SSH brute force         → fail2ban-client status sshd
                           → journalctl -u sshd --since "1 day ago" | grep "Failed password" | wc -l

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

Line L332 explicitly declares the document language as Chinese (Simplified) / English, but the broader license and support workflow strongly center Chinese jurisdiction, Chinese business hours, and Chinese-language interaction without offering users a clear choice of operating language. Under the policy, forcing or effectively requiring a specific language/locale without opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifest requests file.write, terminal.execute, and process.spawn, which enable direct modification of code, configs, and runtime state, yet the user-facing description does not prominently warn that invoking this skill can execute commands and alter the environment. That combination increases the likelihood of users invoking it without understanding the operational and security consequences.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 230)May include surrounding context.

md
| # | Hallucination Type | Symptom | Real-World Example | Iron Countermeasure |
|---|-------------------|---------|-------------------|---------------------|
| H1 | **Screen-Blind Hallucination** | AI does not look at actual screen content, ignores real UI state, skips screenshot/UI dump verification | AI says "login page loaded" without checking `adb screencap` or `uiautomator dump`; claims button is visible without verifying | **MANDATORY SCREEN CAPTURE BEFORE ANY UI CONCLUSION**: `adb shell screencap` + `adb shell uiautomator dump` must be executed and analyzed BEFORE any UI-related statement. NO visual assumption without visual evidence. |
| H2 | **Status-Blind Hallucination** | AI assumes a process/service is running or stopped without checking actual state | AI says "service started" without running `ps aux \| grep service` or checking health endpoint | **MANDATORY STATE VERIFICATION**: Every claim about process/service status MUST be backed by `ps`, `docker ps`, `kubectl get pods`, `ss -tlnp`, or health endpoint curl. NEVER assume state. |
| H3 | **Log-Blind Hallucination** | AI diagnoses root cause without reading actual logs | AI says "OOM killed" without checking `dmesg \| grep oom` or `journalctl`; claims "connection refused" without reading actual error log | **MANDATORY LOG READ**: Before ANY diagnostic conclusion, the relevant log MUST be read via `tail`, `cat`, `docker logs`, `journalctl`, `adb logcat`, or `idevicesyslog`. NO log = NO conclusion. |
| H4 | **API Hallucination** | AI references APIs, methods, libraries, or configs that do not exist in the project | AI calls a function that was never defined; references a Nacos config key that doesn't exist; suggests an npm package not in package.json | **MANDATORY EXISTENCE CHECK**: Before referencing any API/method/config/dependency, MUST verify it exists: `grep -rn` in source code, `cat` the config file, `npm list` the package, `mvn dependency:tree`. If not found → it does NOT exist. |

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 231)May include surrounding context.

md
| # | Hallucination Type | Symptom | Real-World Example | Iron Countermeasure |
|---|-------------------|---------|-------------------|---------------------|
| H1 | **Screen-Blind Hallucination** | AI does not look at actual screen content, ignores real UI state, skips screenshot/UI dump verification | AI says "login page loaded" without checking `adb screencap` or `uiautomator dump`; claims button is visible without verifying | **MANDATORY SCREEN CAPTURE BEFORE ANY UI CONCLUSION**: `adb shell screencap` + `adb shell uiautomator dump` must be executed and analyzed BEFORE any UI-related statement. NO visual assumption without visual evidence. |
| H2 | **Status-Blind Hallucination** | AI assumes a process/service is running or stopped without checking actual state | AI says "service started" without running `ps aux \| grep service` or checking health endpoint | **MANDATORY STATE VERIFICATION**: Every claim about process/service status MUST be backed by `ps`, `docker ps`, `kubectl get pods`, `ss -tlnp`, or health endpoint curl. NEVER assume state. |
| H3 | **Log-Blind Hallucination** | AI diagnoses root cause without reading actual logs | AI says "OOM killed" without checking `dmesg \| grep oom` or `journalctl`; claims "connection refused" without reading actual error log | **MANDATORY LOG READ**: Before ANY diagnostic conclusion, the relevant log MUST be read via `tail`, `cat`, `docker logs`, `journalctl`, `adb logcat`, or `idevicesyslog`. NO log = NO conclusion. |
| H4 | **API Hallucination** | AI references APIs, methods, libraries, or configs that do not exist in the project | AI calls a function that was never defined; references a Nacos config key that doesn't exist; suggests an npm package not in package.json | **MANDATORY EXISTENCE CHECK**: Before referencing any API/method/config/dependency, MUST verify it exists: `grep -rn` in source code, `cat` the config file, `npm list` the package, `mvn dependency:tree`. If not found → it does NOT exist. |

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 232)May include surrounding context.

md
| # | Hallucination Type | Symptom | Real-World Example | Iron Countermeasure |
|---|-------------------|---------|-------------------|---------------------|
| H1 | **Screen-Blind Hallucination** | AI does not look at actual screen content, ignores real UI state, skips screenshot/UI dump verification | AI says "login page loaded" without checking `adb screencap` or `uiautomator dump`; claims button is visible without verifying | **MANDATORY SCREEN CAPTURE BEFORE ANY UI CONCLUSION**: `adb shell screencap` + `adb shell uiautomator dump` must be executed and analyzed BEFORE any UI-related statement. NO visual assumption without visual evidence. |
| H2 | **Status-Blind Hallucination** | AI assumes a process/service is running or stopped without checking actual state | AI says "service started" without running `ps aux \| grep service` or checking health endpoint | **MANDATORY STATE VERIFICATION**: Every claim about process/service status MUST be backed by `ps`, `docker ps`, `kubectl get pods`, `ss -tlnp`, or health endpoint curl. NEVER assume state. |
| H3 | **Log-Blind Hallucination** | AI diagnoses root cause without reading actual logs | AI says "OOM killed" without checking `dmesg \| grep oom` or `journalctl`; claims "connection refused" without reading actual error log | **MANDATORY LOG READ**: Before ANY diagnostic conclusion, the relevant log MUST be read via `tail`, `cat`, `docker logs`, `journalctl`, `adb logcat`, or `idevicesyslog`. NO log = NO conclusion. |
| H4 | **API Hallucination** | AI references APIs, methods, libraries, or configs that do not exist in the project | AI calls a function that was never defined; references a Nacos config key that doesn't exist; suggests an npm package not in package.json | **MANDATORY EXISTENCE CHECK**: Before referencing any API/method/config/dependency, MUST verify it exists: `grep -rn` in source code, `cat` the config file, `npm list` the package, `mvn dependency:tree`. If not found → it does NOT exist. |

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 234)May include surrounding context.

md
| # | Hallucination Type | Symptom | Real-World Example | Iron Countermeasure |
|---|-------------------|---------|-------------------|---------------------|
| H1 | **Screen-Blind Hallucination** | AI does not look at actual screen content, ignores real UI state, skips screenshot/UI dump verification | AI says "login page loaded" without checking `adb screencap` or `uiautomator dump`; claims button is visible without verifying | **MANDATORY SCREEN CAPTURE BEFORE ANY UI CONCLUSION**: `adb shell screencap` + `adb shell uiautomator dump` must be executed and analyzed BEFORE any UI-related statement. NO visual assumption without visual evidence. |
| H2 | **Status-Blind Hallucination** | AI assumes a process/service is running or stopped without checking actual state | AI says "service started" without running `ps aux \| grep service` or checking health endpoint | **MANDATORY STATE VERIFICATION**: Every claim about process/service status MUST be backed by `ps`, `docker ps`, `kubectl get pods`, `ss -tlnp`, or health endpoint curl. NEVER assume state. |
| H3 | **Log-Blind Hallucination** | AI diagnoses root cause without reading actual logs | AI says "OOM killed" without checking `dmesg \| grep oom` or `journalctl`; claims "connection refused" without reading actual error log | **MANDATORY LOG READ**: Before ANY diagnostic conclusion, the relevant log MUST be read via `tail`, `cat`, `docker logs`, `journalctl`, `adb logcat`, or `idevicesyslog`. NO log = NO conclusion. |
| H4 | **API Hallucination** | AI references APIs, methods, libraries, or configs that do not exist in the project | AI calls a function that was never defined; references a Nacos config key that doesn't exist; suggests an npm package not in package.json | **MANDATORY EXISTENCE CHECK**: Before referencing any API/method/config/dependency, MUST verify it exists: `grep -rn` in source code, `cat` the config file, `npm list` the package, `mvn dependency:tree`. If not found → it does NOT exist. |

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 658)May include surrounding context.

md
| # | Hallucination Type | Symptom | Real-World Example | Iron Countermeasure |
|---|-------------------|---------|-------------------|---------------------|
| H1 | **Screen-Blind Hallucination** | AI does not look at actual screen content, ignores real UI state, skips screenshot/UI dump verification | AI says "login page loaded" without checking `adb screencap` or `uiautomator dump`; claims button is visible without verifying | **MANDATORY SCREEN CAPTURE BEFORE ANY UI CONCLUSION**: `adb shell screencap` + `adb shell uiautomator dump` must be executed and analyzed BEFORE any UI-related statement. NO visual assumption without visual evidence. |
| H2 | **Status-Blind Hallucination** | AI assumes a process/service is running or stopped without checking actual state | AI says "service started" without running `ps aux \| grep service` or checking health endpoint | **MANDATORY STATE VERIFICATION**: Every claim about process/service status MUST be backed by `ps`, `docker ps`, `kubectl get pods`, `ss -tlnp`, or health endpoint curl. NEVER assume state. |
| H3 | **Log-Blind Hallucination** | AI diagnoses root cause without reading actual logs | AI says "OOM killed" without checking `dmesg \| grep oom` or `journalctl`; claims "connection refused" without reading actual error log | **MANDATORY LOG READ**: Before ANY diagnostic conclusion, the relevant log MUST be read via `tail`, `cat`, `docker logs`, `journalctl`, `adb logcat`, or `idevicesyslog`. NO log = NO conclusion. |
| H4 | **API Hallucination** | AI references APIs, methods, libraries, or configs that do not exist in the project | AI calls a function that was never defined; references a Nacos config key that doesn't exist; suggests an npm package not in package.json | **MANDATORY EXISTENCE CHECK**: Before referencing any API/method/config/dependency, MUST verify it exists: `grep -rn` in source code, `cat` the config file, `npm list` the package, `mvn dependency:tree`. If not found → it does NOT exist. |

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 1163)May include surrounding context.

md
| # | Hallucination Type | Symptom | Real-World Example | Iron Countermeasure |
|---|-------------------|---------|-------------------|---------------------|
| H1 | **Screen-Blind Hallucination** | AI does not look at actual screen content, ignores real UI state, skips screenshot/UI dump verification | AI says "login page loaded" without checking `adb screencap` or `uiautomator dump`; claims button is visible without verifying | **MANDATORY SCREEN CAPTURE BEFORE ANY UI CONCLUSION**: `adb shell screencap` + `adb shell uiautomator dump` must be executed and analyzed BEFORE any UI-related statement. NO visual assumption without visual evidence. |
| H2 | **Status-Blind Hallucination** | AI assumes a process/service is running or stopped without checking actual state | AI says "service started" without running `ps aux \| grep service` or checking health endpoint | **MANDATORY STATE VERIFICATION**: Every claim about process/service status MUST be backed by `ps`, `docker ps`, `kubectl get pods`, `ss -tlnp`, or health endpoint curl. NEVER assume state. |
| H3 | **Log-Blind Hallucination** | AI diagnoses root cause without reading actual logs | AI says "OOM killed" without checking `dmesg \| grep oom` or `journalctl`; claims "connection refused" without reading actual error log | **MANDATORY LOG READ**: Before ANY diagnostic conclusion, the relevant log MUST be read via `tail`, `cat`, `docker logs`, `journalctl`, `adb logcat`, or `idevicesyslog`. NO log = NO conclusion. |
| H4 | **API Hallucination** | AI references APIs, methods, libraries, or configs that do not exist in the project | AI calls a function that was never defined; references a Nacos config key that doesn't exist; suggests an npm package not in package.json | **MANDATORY EXISTENCE CHECK**: Before referencing any API/method/config/dependency, MUST verify it exists: `grep -rn` in source code, `cat` the config file, `npm list` the package, `mvn dependency:tree`. If not found → it does NOT exist. |

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 1452)May include surrounding context.

md
| # | Hallucination Type | Symptom | Real-World Example | Iron Countermeasure |
|---|-------------------|---------|-------------------|---------------------|
| H1 | **Screen-Blind Hallucination** | AI does not look at actual screen content, ignores real UI state, skips screenshot/UI dump verification | AI says "login page loaded" without checking `adb screencap` or `uiautomator dump`; claims button is visible without verifying | **MANDATORY SCREEN CAPTURE BEFORE ANY UI CONCLUSION**: `adb shell screencap` + `adb shell uiautomator dump` must be executed and analyzed BEFORE any UI-related statement. NO visual assumption without visual evidence. |
| H2 | **Status-Blind Hallucination** | AI assumes a process/service is running or stopped without checking actual state | AI says "service started" without running `ps aux \| grep service` or checking health endpoint | **MANDATORY STATE VERIFICATION**: Every claim about process/service status MUST be backed by `ps`, `docker ps`, `kubectl get pods`, `ss -tlnp`, or health endpoint curl. NEVER assume state. |
| H3 | **Log-Blind Hallucination** | AI diagnoses root cause without reading actual logs | AI says "OOM killed" without checking `dmesg \| grep oom` or `journalctl`; claims "connection refused" without reading actual error log | **MANDATORY LOG READ**: Before ANY diagnostic conclusion, the relevant log MUST be read via `tail`, `cat`, `docker logs`, `journalctl`, `adb logcat`, or `idevicesyslog`. NO log = NO conclusion. |
| H4 | **API Hallucination** | AI references APIs, methods, libraries, or configs that do not exist in the project | AI calls a function that was never defined; references a Nacos config key that doesn't exist; suggests an npm package not in package.json | **MANDATORY EXISTENCE CHECK**: Before referencing any API/method/config/dependency, MUST verify it exists: `grep -rn` in source code, `cat` the config file, `npm list` the package, `mvn dependency:tree`. If not found → it does NOT exist. |

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 451)May include surrounding context.

md
RULE 5: CONFIDENCE INTERVAL FOR COUNTS
  If you cannot verify the exact count:
    → Report range: "15-20 views (exact count pending full scan)"
    → NEVER report exact number without verification
    → Mark unverified counts as [ESTIMATED] in reports

MINIMUM EVIDENCE FOR ANY QUANTITY CLAIM:

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 464)May include surrounding context.

md
#### H15: FRAMEWORK BEHAVIOR ASSUMPTION HALLUCINATION (THE #3 ERROR)

**Symptom**: AI assumes framework behavior from general knowledge WITHOUT checking the specific version/configuration used in THIS project.
**Real Error**: Concluded "Mapper XML missing → MyBatis cannot run" — WRONG for MyBatis-Plus which has built-in generic CRUD.

**Framework-Specific Behavior Knowledge Base**:

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 510)May include surrounding context.

✅ Permissions declared in AndroidManifest.xml ARE declared ✅ Runtime permissions may ALSO need requestPermissions() calls ⚠️ To check: ALWAYS read the actual AndroidManifest.xml file ⚠️ Do NOT assume permission is missing without reading the file

text

**Mandatory Pre-Conclusion Check for Any Framework-Related Statement**:

Persistent Context Injection

Medium
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill injects content designed to persist in agent memory or context across interactions. Persistent injection can alter agent behavior long after the initial interaction.

Content

Scanner excerpt · SKILL.md (reported line 519)May include surrounding context.

md
1. Which exact framework version? → Check pom.xml/build.gradle/package.json
2. Is this behavior true for THAT version? → Verify via docs or source code
3. Does THIS project's configuration change default behavior? → Check config files
4. Am I confusing this with a DIFFERENT framework? → Run classification protocol (H13)

If unsure on ANY question → Mark as "requires verification" → DO NOT state as fact

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 2516)May include surrounding context.

md
| MongoDB | Document store | `mongosh --eval "db.adminCommand('ping')"` | `show dbs`, `db.collection.find().limit(10)` |
| Docker | Container runtime | `docker --version` | `docker ps`, `docker logs container_name`, `docker-compose up -d` |
| kubectl | K8s management | `kubectl version --client` | `kubectl get pods`, `kubectl logs pod_name`, `kubectl describe pod` |
| curl | API testing | `curl --version` | `curl -X GET/POST/PUT/DELETE url -H "Authorization: Bearer token" -d '{"key":"val"}'` |
| jq | JSON parsing | `jq --version` | `curl ... \| jq '.'`, `cat file.json \| jq '.key'` |

**Diagnostic Flow (Real Commands Only)**:

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 2547)May include surrounding context.

md
| scp | File transfer | `scp --version` | `scp file user@host:/path`, `scp -r dir/ user@host:/path` |
| nginx | Reverse proxy | `nginx -t` (syntax check) | `nginx -s reload`, `cat /etc/nginx/conf.d/upstream.conf` |
| docker | Container management | `docker ps` | `docker-compose -f file.yml up -d`, `docker-compose down`, `docker logs -f container` |
| systemctl | Service management | `systemctl status nginx` | `systemctl start/stop/restart service`, `systemctl enable service` |
| journalctl | System logs | `journalctl -u service --since "1 hour ago"` | `journalctl -u service --no-pager -n 100` |
| netstat / ss | Port scanning | `ss -tlnp` | `ss -tlnp | grep :8080`, `lsof -i :8080` |
| top / htop | Resource monitor | `top -bn1 | head -20` | `free -h`, `df -h`, `iostat -x 1 3` |

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 2648)May include surrounding context.

md
| ios-deploy | USB install | `ios-deploy --version` | `ios-deploy --bundle app.ipa --debug`, `ios-deploy --list_bundle_id` |
| cfgutil | Device management | `cfgutil list` | `cfgutil install app.ipa`, `cfgutil get deviceType` |
| security | Keychain/certs | `security find-identity -v -p codesigning` | `security unlock-keychain`, `security find-certificate -a -p keychain` |
| plutil | Plist editing | `plutil -lint Info.plist` | `plutil -convert xml1 file.plist`, `plutil -p Info.plist` |
| fastlane | Automation | `fastlane --version` | `fastlane gym`, `fastlane pilot`, `fastlane deliver` |
| libimobiledevice | USB debug | `ideviceinfo -s` | `idevicesyslog`, `idevicecrashreport`, `idevicescreenshot` |

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 2673)May include surrounding context.

md
| ios-deploy | USB install | `ios-deploy --version` | `ios-deploy --bundle app.ipa --debug`, `ios-deploy --list_bundle_id` |
| cfgutil | Device management | `cfgutil list` | `cfgutil install app.ipa`, `cfgutil get deviceType` |
| security | Keychain/certs | `security find-identity -v -p codesigning` | `security unlock-keychain`, `security find-certificate -a -p keychain` |
| plutil | Plist editing | `plutil -lint Info.plist` | `plutil -convert xml1 file.plist`, `plutil -p Info.plist` |
| fastlane | Automation | `fastlane --version` | `fastlane gym`, `fastlane pilot`, `fastlane deliver` |
| libimobiledevice | USB debug | `ideviceinfo -s` | `idevicesyslog`, `idevicecrashreport`, `idevicescreenshot` |

Static analysis

No suspicious patterns detected.