ClawHub
Back to skill

Security audit

DoubleAgent — Generator-Evaluator Dual Agent Pattern

Security checks for vulnerabilities and agentic risk

Overview

This skill is a transparent template for separating AI generation and evaluation work, with only expected local template reads and an optional log write.

Installers should treat this as a design/template skill, not a turnkey sandbox. When adapting it, grant Playwright, file, network, and credential access only for the specific artifact, spec, and test environment being evaluated, and avoid using production credentials in evaluator prompts or logs.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding

The skill references local files such as references/architecture.md, references/evaluator-prompts.md, and scripts under scripts/, which implies file-read capability and may lead an agent to access additional repository content without any explicit tool-scope declaration. In an agent system, undeclared file access expands the effective trust boundary and can expose sensitive files or enable unintended processing of local code and prompts if the runtime grants broad filesystem access by default.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The _save_log function performs a file write to output_log, which may overwrite an existing file and persist evaluation history. While the CLI argument names the log path, the code provides no confirmation prompt or cautionary comment/docstring warning that data will be written to disk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.