ClawHub
Back to skill

Security audit

AI Editor Rules

Security checks for vulnerabilities and agentic risk

Overview

This is mostly a static editor-rules template, but it needs Review because it encourages persistent agent memory/credential notes and recommends an unpinned global npm install.

Install only if you are comfortable reviewing and editing the templates first. Remove or tighten the memory rules before use, do not store credentials in project files, and avoid the global `crossrule` install unless you have verified and pinned a trusted version or can use a safer local/manual conversion path.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T02 · Agent Memory Poisoning

Warning
Location
references/agents-md.txt:43
Finding

Persistent Agent Memory Can Store Untrusted Instructions and Plaintext Credential Notes

Content
View full analysis
Brain** ### Recommended Structure workspace/ ├── AGENTS.md # This file - rules and practices ├── MEMORY.md # Long-term curated memory ├── TOOLS.md # Local tool notes (credentials, quirks, fixes) └── memory/ └── YYYY-MM-DD.md # Daily logs ``` ### Technical Analysis The template directs an AI Agent to persist information across sessions without requiring content validation or explicit user authorization for each write. Because `AGENTS.md`, `MEMORY.md`, and related files may be consumed by future Agent sessions, untrusted content written into them can continue influencing behavior after the original interaction ends. The reference to `TOOLS.md` as a location for “credentials” also encourages sensitive information to be stored in plaintext within the workspace. Such files may be indexed by development tools, copied into backups, included in support bundles, or accidentally committed to version control. Persistent memory is not necessary for the Skill’s primary function of supplying coding conventions. The behavior therefore exceeds the minimum privileges required for an editor-rules template. ### Attack Path 1. A user copies the template into a project as `AGENTS.md`. 2. The Agent treats the memory-writing instructions as mandatory workspace policy. 3. Untrusted project content, tool output, or a user-supplied instruction asks the Agent to “remember” attacker-controlled ...[truncated 870 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:27
Finding

Unpinned Third-Party Package Is Installed and Executed Globally

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The description and primary instructional text are written in Chinese, which implies the skill operates in a fixed language. Under the policy, locale or language constraints should either be justified as region-specific or provide the user with an explicit choice; neither is present here.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/agents-md.txt (reported line 12)May include surrounding context.

text
### The 15 Rules

1. **Confirm before executing** — Repeat back the task before starting
2. **Never publish without approval** — Show draft → get OK → then post
3. **Spawn agents only when truly needed** — Simple tasks = do yourself
4. **When user says STOP, you stop** — Full stop, re-read chat
5. **Simpler path first** — Don't fight broken tools for 20 min

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/agents-md.txt (reported line 159)May include surrounding context.

text
### The 15 Rules

1. **Confirm before executing** — Repeat back the task before starting
2. **Never publish without approval** — Show draft → get OK → then post
3. **Spawn agents only when truly needed** — Simple tasks = do yourself
4. **When user says STOP, you stop** — Full stop, re-read chat
5. **Simpler path first** — Don't fight broken tools for 20 min

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/windsurf-rules.txt (reported line 141)May include surrounding context.

text
- Do NOT use `console.log` — use a proper logger that's stripped in production.
- Do NOT hardcode colors or spacing. Use theme tokens.
- Do NOT use `setTimeout` for animation. Use Reanimated.
- Do NOT install native modules without checking Expo compatibility first.

Static analysis

No suspicious patterns detected.