ClawHub
Back to skill

Security audit

LGD Certify（LGD 三律闭环认证）

Security checks for vulnerabilities and agentic risk

Overview

This skill can issue passing certificates without verifying evidence and does not preserve the audit history it promises.

Treat certificates and badges as unverified local bookkeeping, not proof of compliance or evidence integrity. Independently review the evidence before relying on PASS, preserve separate audit backups, and use a dedicated project directory without symbolic links. All seven bundled files were inspected; external installation sources were not audited. The Review verdict reflects verified integrity and containment problems, without evidence of malicious intent.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

The certification gate accepts cached coverage claims without verifying the passport or evidence it certifies.

High
Category
Excessive Agency
Confidence
99% confidence
Finding

The gate trusts editable lgd_state.json fields, including classes_covered and stored hashes, without recomputing passport integrity, validating evidence blocks, or checking current evidence files. A project contributor can forge these fields, or remove or alter previously scanned evidence, and still receive a PASS certificate and badges. This is particularly dangerous for a certification tool because its primary output presents unverified claims as successful governance review.

Content

No source excerpt is available for this finding.

Evidence reruns replace historical blocks despite explicitly promising incremental collection.

Medium
Category
Excessive Agency
Confidence
99% confidence
Finding

Each evidence run initializes an empty block list but links its first new block to the previous saved head, then overwrites both stored copies of the chain with only the newly scanned blocks. Historical blocks therefore disappear while their hash remains as an unresolved predecessor, preventing independent verification of continuity and allowing previously recorded evidence to vanish from the audit history. This undermines the skill's explicit incremental-collection and tamper-evidence guarantees, although it does not itself execute code or transmit data.

Content

No source excerpt is available for this finding.