ClawHub
Back to skill

Security audit

Gate Policy Generator（权限门禁策略生成器）

Security checks for vulnerabilities and agentic risk

Overview

This policy generator needs review because its safety checks miss conflicting permissions and its instructions extend to insufficiently scoped deployment.

Use this as a draft generator in a restricted project directory. Choose paths carefully, avoid symlinks and unintended overwrites, and independently review permission conflicts and budgets. A passing check does not establish effective protection. Require explicit approval of the target environment and permission changes before deployment, with a tested recovery plan. No exfiltration or malicious execution was found; downstream enforcement remains unverified.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

The workflow instructs deployment of generated permissions without warning about effects on the running environment.

Medium
Category
Output Handling
Confidence
87% confidence
Finding

Step 6 directs the agent to deploy the generated policy and activate its permissions, rather than merely generate a configuration file; L111 repeats this instruction. The description does not warn that applying the policy changes live access controls and could interrupt legitimate operations or unintentionally grant access; the general security-scan disclaimer does not explain these effects.

Content

No source excerpt is available for this finding.

File operations are not confined to the declared project-dir-only scope.

Medium
Category
Excessive Agency
Confidence
98% confidence
Finding

The script passes user-supplied --out, --manifest, and --check paths directly to open() without enforcing a project-root boundary or rejecting symbolic links. If an attacker can influence these arguments or filesystem links, the script can read files or truncate writable files outside the declared project-dir-only scope; the security-policy generation context makes this boundary mismatch particularly misleading.

Content

No source excerpt is available for this finding.