ClawHub
Back to skill

Security audit

agent-kill-switch

Security checks for vulnerabilities and agentic risk

Overview

This is a small local tool for generating and checking deployment kill-card JSON, with documentation mismatches but no hidden, destructive, persistent, or exfiltrating behavior found.

Before installing, verify the intended CLI syntax yourself because SKILL.md documents flags that the script does not support. Also review the broader allowed-tools declaration and the license wording if those matter for your environment. For security behavior, the inspected package is a local checker/generator and does not appear to perform network access, credential use, persistence, or destructive actions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
91% confidence
Finding

The documented --skip-check flag explicitly allows bypassing the kill-switch validation whose stated purpose is to block unsafe launches when required fields are missing. In a pre-deployment safety-control skill, even a 'local testing only' bypass is dangerous because it normalizes a control-evasion path and may be copied into real deployment workflows or abused by automation.

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

md
### Usage
1. Core script: `agent_kill_switch.py` — `python agent_kill_switch.py --check`.
2. Params: `--input-config` (kill-card file path), `--skip-check` (local testing only).
3. Verdict: rc=0 fields complete and validated; rc=1 missing fields — launch blocked.

### Flow

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
91% confidence
Finding

This is the same bypass pattern repeated in the Chinese usage section: --skip-check permits skipping the very verification intended to enforce emergency-stop readiness before launch. Because the skill's context is AI governance and deployment safety, a bypass parameter is more dangerous here than in ordinary tooling: it can directly undermine a critical operational safeguard and enable deployment without required stop/recovery controls.

Content

Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.

md
### 用法
1. 核心脚本：`agent_kill_switch.py`，调用方式为 `python agent_kill_switch.py --check`。
2. 参数说明：`--input-config`（制动卡文件路径），`--skip-check`（仅用于本地测试跳过验证）。
3. 结果判断：字段齐全且通过校验返回 `0`，缺项失败返回 `1` 不许上线。

### 流程

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The file is written entirely in Chinese and presents itself as the operative instructions for AI agents, but it does not offer any language/locale choice or explain that the skill is intentionally limited to a Chinese-speaking context. This can violate language/locale policy requirements when skills are expected to avoid forcing a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The top-level manifest description is written primarily in Chinese, and the changelog later states a bilingual rewrite with 'English first', but the actual leading description and display name remain Chinese-led. This can violate a language/locale policy when the skill is presented to users without offering an explicit language choice or opt-in at activation time.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The file’s user-facing documentation and usage examples are entirely in Chinese, and the argparse description/help strings later in the file also continue that pattern. This effectively forces a specific language for users without offering a locale choice or documenting that the tool is region-specific.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium
Category
Dangerous Code Execution
Confidence
75% confidence
Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/agent_kill_switch.py (reported line 22)May include surrounding context.

python
card = {"card_type": "lgd-agent-kill-switch", "agent": a.agent,
            "conditions": a.conditions or [], "revoke": a.revoke,
            "owner": a.owner, "recovery": a.recovery,
            "generated_at": __import__("datetime").date.today().isoformat()}
    miss = []
    if not card["conditions"]:
        miss.append("conditions(停止条件)")

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The command-line interface presents all descriptions and help messages only in Chinese. Under the policy, a skill should not require a specific language unless users can opt in or the regional constraint is clearly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The title presents Chinese first ("智能体紧急制动卡") with English secondary, which indicates a language preference in the skill's natural-language presentation. The file does not state that users may choose their preferred language or that the Chinese-first format is region-specific and justified.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

The README presents the skill as a ready-to-use zero-dependency package, while the later copied compliance block states that the package has no attached LICENSE file and that the code license is pending. This is a documentation-level contradiction within the file about the package's published state and governance metadata.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The documentation says the script is called with --input-config and --skip-check, but the manifest's declared input schema only lists agent, check, conditions, revoke, owner, recovery, out, and json. This is an intent/documentation mismatch because the documented interface contradicts the declared interface for how the skill is supposed to be invoked.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The file’s human-readable instructions are entirely in Chinese, with no indication that users or agents may choose another language or locale. Under the stated policy, a language constraint should either be optional/opt-in or clearly justified as region-specific.

Content

No source excerpt is available for this finding.