Security audit

workflow-skill-designer

Security checks for vulnerabilities and agentic risk

Overview

ClawScan marks this skill suspicious because scanners report that it grants generated skills broad tools such as shell and file editing regardless of need; some referenced content was only partly inspected.

Consider avoiding installation unless you need this skill and can review the permissions it generates. The main reported concern is that generated skills may receive more tool access than their workflows require. Scanner coverage was partial, so the scan does not establish that the uninspected portions are safe.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
Rogue AgentSelf-Modification, Session Persistence
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The frontmatter conversion rules explicitly instruct adding commonly needed tools rather than preserving the source workflow's permission boundaries. Although generating tool declarations fits this skill's purpose, unnecessary permission expansion can give downstream skills shell and file-modification capabilities, increasing the consequences of malicious instructions or mistakes where the host honors those declarations.
Content: No source excerpt is available for this finding.

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 341)May include surrounding context.
md
└─ Ref: phases/01-requirements-analysis.md

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 364)May include surrounding context.
md
| 1 | [phases/01-requirements-analysis.md](phases/01-requirements-analysis.md) | Analyze workflow requirements from various sources |

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 433)May include surrounding context.
md
> **参考伪代码例外**: 本元技能自身的阶段设计文档（`phases/01-requirements-analysis.md` 等）中可能包含 `extractYAMLFrontmatter()`、`parseRequirements()` 等参考伪代码函数，用于勾勒解析意图。这些**仅存在于本技能的设计文档中**

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 346)May include surrounding context.
md
└─ Ref: phases/02-orchestrator-design.md

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 365)May include surrounding context.
md
| 2 | [phases/02-orchestrator-design.md](phases/02-orchestrator-design.md) | Generate SKILL.md with orchestration patterns |

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 351)May include surrounding context.
md
└─ Ref: phases/03-phase-design.md

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 366)May include surrounding context.
md
| 3 | [phases/03-phase-design.md](phases/03-phase-design.md) | Generate phase files preserving full execution detail |

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 356)May include surrounding context.
md
└─ Ref: phases/04-validation.md

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 367)May include surrounding context.
md
| 4 | [phases/04-validation.md](phases/04-validation.md) | Validate structure, references, and integration |

Frontmatter conversion unconditionally grants generated skills shell execution and file-modification tools, regardless of their workflow requirements.

Medium

Category: Excessive Agency
Confidence: 99% confidence
Finding: expandToolWildcards unconditionally merges Bash, Write, Edit, and other capabilities into the source tool list, even for read-only workflows. This propagates excessive permissions into generated skills and can amplify prompt injection or execution mistakes when the host uses allowed-tools to authorize actions; it does not itself bypass independent host restrictions.
Content: No source excerpt is available for this finding.

Generated preference prompts use Chinese without user language opt-in.

Medium

Category: Output Handling
Confidence: 96% confidence
Finding: The auto-mode question and option descriptions are hardcoded in Chinese in the generated user-facing preference dialog. No language selection or locale-specific justification is provided, so enabling this feature imposes Chinese prompts regardless of the user's language.
Content: No source excerpt is available for this finding.

Frontmatter conversion grants generated skills additional capabilities regardless of their requirements or original tool restrictions.

Medium

Category: Excessive Agency
Confidence: 99% confidence
Finding: The conversion function adds a fixed set of tools including Bash, Write, and Edit regardless of the source restrictions or actual phase requirements. Because this is a skill generator, the excessive permissions can spread to multiple generated skills and increase the impact of downstream prompt injection or accidental actions where those permissions are honored.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 80% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · phases/04-validation.en.md (reported line 502)May include surrounding context.
md
| WSD-E06 | Data flow variable declared in SKILL.md but not in body | Add variable description in SKILL.md Data Flow section | | WSD-E07 | SKILL.md missing required sections (Architecture / Execution Flow / Core Rules / Data Flow / Error Handling) | Complete sections per SKILL.md template | | WSD-W01 | Description missing "Triggers on" phrase | Append `Triggers on "..."` at end of description | | WSD-W02 | Phase file not referenced in SKILL.md | Add entry to Phase Reference Documents table | | WSD-W03 | Command-extracted phase line ratio 0.7–0.9 | Check for intentional simplification; otherwise regenerate via Phase 3 | | WSD-W04 | Recommended sections missing (Key Design Principles / Input Processing / etc.) | Optional — improves readability |