ClawHub
Back to skill

Security audit

StoweCraft Artisan Concierge

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed, read-only public directory helper for a Stowe artisan gallery, with clear limits around stale data and lead handling.

Before installing, treat this as a research-derived public directory helper rather than an official merchant system. Ask it to disclose freshness and uncertainty for hours, inventory, events, prices, and availability, and only provide contact details when you explicitly want a lead handoff preview prepared.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Low
Confidence
90% confidence
Finding
This JSON manifest uses natural-language 'Use when...' descriptions as trigger guidance, and the phrase 'wants a portable handmade gift with an artist story' is broad enough to overlap with many ordinary shopping requests. The file does not provide explicit trigger constraints or negative examples to clarify when this entry should or should not be selected.

Vague Triggers

Low
Confidence
88% confidence
Finding
The story text 'Use when a traveler wants a durable object tied to the Stowe trip' is suggestive but not precise about what distinguishes this item from other gift or souvenir categories. Without explicit constraints or negative examples, a routing system could invoke this entry for a wide range of generic travel-memory requests.

Vague Triggers

Low
Confidence
95% confidence
Finding
The phrase 'Use for dinner hosts, inn hosts, event hosts, and thank-you gifts' covers a very wide set of common gift scenarios and lacks boundaries for when this category is preferred over others. Because this is a manifest file, broad routing language like this can lead to unintended matches in everyday conversations.

Static analysis

No suspicious patterns detected.