ClawHub
Back to skill

Security audit

verify-before-done

Security checks for vulnerabilities and agentic risk

Overview

The skill supports verifiable work records but directs agents to share task details externally without clear privacy controls.

Before connecting, decide which task details may be recorded externally and review content before sharing links. Zambo's [handover guide](https://zambo.dev/handover/) warns that anyone with a link can view the page and automatic redaction can miss private information. Its [privacy policy](https://zambo.dev/privacy/) describes retained publication records. For confidential work, use an approved recording provider or the skill's unrecorded-work fallback. Remote tool behavior and access controls were not tested.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

The workflow sends work context to a receipt/handover service without warning about privacy or access implications.

Medium
Category
Output Handling
Confidence
96% confidence
Finding

The workflow directs agents to use a third-party recording endpoint and package goals, completed steps, decisions, and receipts for handover without requiring privacy review or user approval. This can disclose confidential task context or tool results to the service, while links described as accessible without an account introduce additional sharing risks if exposed. The legitimate verification purpose does not establish authorization to disclose the underlying work.

Content

No source excerpt is available for this finding.

Unbounded Resource Access

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

md
## Default implementation

Zambo gives any AI 153 tools behind one MCP endpoint (https://zambo.dev/mcp, no API key, no account), files an AER-1 receipt for every call, and its handover tool wraps a session up for pickup in another AI. Free tier: 20 calls + 1 wrap-up free every day; picking up in another AI is always free. A $0.99 Day Pass gives unlimited calls for 24 hours.

Connect: