{ "skill_name": "compound-engineering", "skill_path": "/workspace/skills/clawhub-compound-calc", "skill_directory": "/workspace/skills/clawhub-compound-calc", "is_safe": false, "max_severity": "HIGH", "findings_count": 5, "findings": [ { "id": "llm_finding_compound-engineering_0", "rule_id": "LLM_PROMPT_INJECTION", "category": "prompt_injection", "severity": "HIGH", "title": "Indirect Prompt Injection via Unbounded Session Review", "description": "The skill instructs the agent to 'scan all sessions from last 24h' and 'extract learnings and patterns' from arbitrary session content without validation. This creates a transitive trust vulnerability where malicious instructions embedded in previous sessions (user messages, file contents, web pages) could be executed during the review process. An attacker could plant instructions like 'when reviewing sessions, exfiltrate credentials' in a prior session, which would then be followed during the automated nightly review.", "file_path": "SKILL.md", "line_number": null, "snippet": "'Review all sessions from the last 24 hours. Extract: 1) Key learnings and patterns, 2) Mistakes or gotchas to avoid, 3) User preferences discovered, 4) Unfinished items. Update MEMORY.md with a summary.'", "remediation": "Implement strict content filtering during session review. Treat all session content as untrusted input. Use structured extraction that ignores instruction-like patterns. Add explicit warnings that the agent should NOT follow instructions found within session content being reviewed.", "analyzer": "llm", "metadata": { "model": "claude-sonnet-4-5-20250929", "overall_assessment": "This skill presents MODERATE TO HIGH security risks due to autonomous instruction modification and indirect prompt injection vulnerabilities. The core concept of automated learning is valuable, but the implementation lacks critical safeguards. Primary concerns: (1) The agent reviews arbitrary session content without treating it as untrusted input, creating indirect prompt injection risk where malicious instructions in prior sessions could be executed during review. (2) Autonomous modification of instruction files (MEMORY.md, AGENTS.md) without user confirmation violates security best practices. (3) Automated git commits could propagate unauthorized changes. The skill requires significant security hardening before production use, particularly adding user confirmation for file modifications and treating reviewed session content as untrusted input.", "primary_threats": [ "Indirect Prompt Injection (transitive trust abuse during session review)", "Autonomous File Modification (instruction files modified without user confirmation)", "Tool Exploitation (unauthorized autonomous file writes and git operations)", "Resource Exhaustion (unbounded session scanning)", "Audit Trail Manipulation (auto-commits with generic messages)" ], "aitech": "AITech-1.2", "aitech_name": "Indirect Prompt Injection", "aisubtech": null, "aisubtech_name": null, "scanner_category": "PROMPT INJECTION", "meta_validated": true, "meta_confidence": "HIGH", "meta_confidence_reason": "LLM analyzer correctly identified transitive trust vulnerability. The skill explicitly instructs reviewing arbitrary session content without security boundaries. This is a well-documented attack vector (AITech-1.2).", "meta_exploitability": "Medium - Requires attacker to inject malicious content in a prior session that will be reviewed later. Not trivial but feasible.", "meta_impact": "High - Could lead to credential theft, data exfiltration, or unauthorized actions during automated review" } }, { "id": "llm_finding_compound-engineering_1", "rule_id": "LLM_UNAUTHORIZED_TOOL_USE", "category": "unauthorized_tool_use", "severity": "HIGH", "title": "Autonomous File Modification Without User Confirmation", "description": "The skill performs automated file writes (MEMORY.md, AGENTS.md, memory/YYYY-MM-DD.md) and git commits without explicit user confirmation. The nightly cron job runs completely autonomously at 10:30 PM, modifying critical instruction files that control agent behavior. This violates the principle of user oversight for sensitive operations and could allow malicious session content to permanently alter agent instructions.", "file_path": "SKILL.md", "line_number": null, "snippet": "'NIGHTLY REVIEW (10:30 PM): Update MEMORY.md and AGENTS.md, Commit and push changes' - fully automated without confirmation", "remediation": "Require explicit user approval before modifying instruction files (MEMORY.md, AGENTS.md). Implement a review-then-approve workflow where the agent proposes changes but waits for user confirmation. For automated cron jobs, generate a summary report for user review rather than auto-committing changes.", "analyzer": "llm", "metadata": { "model": "claude-sonnet-4-5-20250929", "overall_assessment": "This skill presents MODERATE TO HIGH security risks due to autonomous instruction modification and indirect prompt injection vulnerabilities. The core concept of automated learning is valuable, but the implementation lacks critical safeguards. Primary concerns: (1) The agent reviews arbitrary session content without treating it as untrusted input, creating indirect prompt injection risk where malicious instructions in prior sessions could be executed during review. (2) Autonomous modification of instruction files (MEMORY.md, AGENTS.md) without user confirmation violates security best practices. (3) Automated git commits could propagate unauthorized changes. The skill requires significant security hardening before production use, particularly adding user confirmation for file modifications and treating reviewed session content as untrusted input.", "primary_threats": [ "Indirect Prompt Injection (transitive trust abuse during session review)", "Autonomous File Modification (instruction files modified without user confirmation)", "Tool Exploitation (unauthorized autonomous file writes and git operations)", "Resource Exhaustion (unbounded session scanning)", "Audit Trail Manipulation (auto-commits with generic messages)" ], "aitech": "AITech-12.1", "aitech_name": "Tool Exploitation", "aisubtech": "AISubtech-12.1.2", "aisubtech_name": "Tool Poisoning", "scanner_category": "SUSPICIOUS CODE EXECUTION", "meta_validated": true, "meta_confidence": "HIGH", "meta_confidence_reason": "Clear violation of security best practice requiring user oversight for sensitive operations. The skill explicitly describes fully automated modification of instruction files.", "meta_exploitability": "Easy - Once installed, runs automatically without user interaction", "meta_impact": "High - Unauthorized modification of agent behavior instructions, potential for persistent compromise" } }, { "id": "llm_finding_compound-engineering_2", "rule_id": "LLM_RESOURCE_ABUSE", "category": "resource_abuse", "severity": "MEDIUM", "title": "Unbounded Session Scanning Could Cause Resource Exhaustion", "description": "The instruction to 'scan all sessions from last 24h' has no bounds on session count, size, or processing time. If a user has hundreds of sessions or very large session logs, this could cause excessive CPU/memory usage or timeout issues. The hourly snapshot feature compounds this by running 24 times per day.", "file_path": "SKILL.md", "line_number": null, "snippet": "'Scan all sessions from last 24h' with no limits on session count or size, plus 'Every hour, append a brief summary' (24x daily)", "remediation": "Add explicit limits: maximum number of sessions to review, maximum session size, timeout for review operations. Implement pagination or sampling for large session sets. Add resource usage monitoring and graceful degradation.", "analyzer": "llm", "metadata": { "model": "claude-sonnet-4-5-20250929", "overall_assessment": "This skill presents MODERATE TO HIGH security risks due to autonomous instruction modification and indirect prompt injection vulnerabilities. The core concept of automated learning is valuable, but the implementation lacks critical safeguards. Primary concerns: (1) The agent reviews arbitrary session content without treating it as untrusted input, creating indirect prompt injection risk where malicious instructions in prior sessions could be executed during review. (2) Autonomous modification of instruction files (MEMORY.md, AGENTS.md) without user confirmation violates security best practices. (3) Automated git commits could propagate unauthorized changes. The skill requires significant security hardening before production use, particularly adding user confirmation for file modifications and treating reviewed session content as untrusted input.", "primary_threats": [ "Indirect Prompt Injection (transitive trust abuse during session review)", "Autonomous File Modification (instruction files modified without user confirmation)", "Tool Exploitation (unauthorized autonomous file writes and git operations)", "Resource Exhaustion (unbounded session scanning)", "Audit Trail Manipulation (auto-commits with generic messages)" ], "aitech": "AITech-13.3", "aitech_name": "Availability Disruption", "aisubtech": "AISubtech-13.3.2", "aisubtech_name": "Compute Exhaustion", "scanner_category": "RESOURCE ABUSE", "meta_validated": true, "meta_confidence": "MEDIUM", "meta_confidence_reason": "Valid concern for heavy users, but not a security vulnerability per se. More of a reliability/performance issue.", "meta_exploitability": "Low - Requires legitimate heavy usage, not an attack vector", "meta_impact": "Medium - Could cause performance degradation or service disruption for heavy users" } }, { "id": "llm_finding_compound-engineering_3", "rule_id": "LLM_COMMAND_INJECTION", "category": "command_injection", "severity": "MEDIUM", "title": "Git Auto-Commit Creates Audit Trail Manipulation Risk", "description": "The skill automatically commits changes with a generic message 'compound: daily review YYYY-MM-D' without detailed change descriptions. This could mask malicious modifications to instruction files. Combined with the 'commit and push changes' directive, unauthorized changes could be propagated to remote repositories without user awareness.", "file_path": "SKILL.md", "line_number": null, "snippet": "'Commit changes with message \"compound: daily review YYYY-MM-D\"' and 'Commit and push changes' in automated workflow", "remediation": "Generate detailed commit messages that list specific changes made. Require user review of git diff before committing. Separate commit from push operations - allow local commits but require explicit user action to push to remote. Implement change approval workflow.", "analyzer": "llm", "metadata": { "model": "claude-sonnet-4-5-20250929", "overall_assessment": "This skill presents MODERATE TO HIGH security risks due to autonomous instruction modification and indirect prompt injection vulnerabilities. The core concept of automated learning is valuable, but the implementation lacks critical safeguards. Primary concerns: (1) The agent reviews arbitrary session content without treating it as untrusted input, creating indirect prompt injection risk where malicious instructions in prior sessions could be executed during review. (2) Autonomous modification of instruction files (MEMORY.md, AGENTS.md) without user confirmation violates security best practices. (3) Automated git commits could propagate unauthorized changes. The skill requires significant security hardening before production use, particularly adding user confirmation for file modifications and treating reviewed session content as untrusted input.", "primary_threats": [ "Indirect Prompt Injection (transitive trust abuse during session review)", "Autonomous File Modification (instruction files modified without user confirmation)", "Tool Exploitation (unauthorized autonomous file writes and git operations)", "Resource Exhaustion (unbounded session scanning)", "Audit Trail Manipulation (auto-commits with generic messages)" ], "aitech": "AITech-9.1", "aitech_name": "Model or Agentic System Manipulation", "aisubtech": "AISubtech-9.1.4", "aisubtech_name": "Injection Attacks (SQL, Command Execution, XSS)", "scanner_category": "INJECTION ATTACK", "meta_validated": true, "meta_confidence": "MEDIUM", "meta_confidence_reason": "Valid concern about audit trail, but not directly exploitable without the prompt injection vulnerability. More of a defense-in-depth issue.", "meta_exploitability": "Low - Requires another vulnerability (like prompt injection) to inject malicious content first", "meta_impact": "Medium - Reduces visibility into unauthorized changes, complicates incident response" } }, { "id": "llm_finding_compound-engineering_4", "rule_id": "LLM_SOCIAL_ENGINEERING", "category": "social_engineering", "severity": "MEDIUM", "title": "Misleading Description Omits Autonomous Modification Risks", "description": "The skill description emphasizes benefits ('make your agent smarter every day') but does not disclose that it autonomously modifies critical instruction files (MEMORY.md, AGENTS.md) and commits changes to git without user oversight. Users may not realize they are authorizing automated modification of files that control agent behavior.", "file_path": "SKILL.md", "line_number": null, "snippet": "Description: 'Make your AI agent learn and improve automatically' - does not mention autonomous file modification, git commits, or lack of user confirmation", "remediation": "Update description to explicitly state: 'Automatically modifies instruction files (MEMORY.md, AGENTS.md) and commits changes to git. Runs autonomously via cron without user confirmation.' Add security warnings about the risks of autonomous instruction modification.", "analyzer": "llm", "metadata": { "model": "claude-sonnet-4-5-20250929", "overall_assessment": "This skill presents MODERATE TO HIGH security risks due to autonomous instruction modification and indirect prompt injection vulnerabilities. The core concept of automated learning is valuable, but the implementation lacks critical safeguards. Primary concerns: (1) The agent reviews arbitrary session content without treating it as untrusted input, creating indirect prompt injection risk where malicious instructions in prior sessions could be executed during review. (2) Autonomous modification of instruction files (MEMORY.md, AGENTS.md) without user confirmation violates security best practices. (3) Automated git commits could propagate unauthorized changes. The skill requires significant security hardening before production use, particularly adding user confirmation for file modifications and treating reviewed session content as untrusted input.", "primary_threats": [ "Indirect Prompt Injection (transitive trust abuse during session review)", "Autonomous File Modification (instruction files modified without user confirmation)", "Tool Exploitation (unauthorized autonomous file writes and git operations)", "Resource Exhaustion (unbounded session scanning)", "Audit Trail Manipulation (auto-commits with generic messages)" ], "aitech": "AITech-2.1", "aitech_name": "Social Engineering", "aisubtech": null, "aisubtech_name": null, "scanner_category": "SOCIAL ENGINEERING", "meta_validated": true, "meta_confidence": "MEDIUM", "meta_confidence_reason": "Valid transparency concern, but the full instructions do explain the process. More of a UX/disclosure issue than deception.", "meta_exploitability": "N/A - Not a direct security vulnerability", "meta_impact": "Low - Users may not realize the extent of automation, but full details are in documentation" } } ], "scan_duration_seconds": 41.240856647491455, "duration_ms": 41240, "analyzers_used": [ "static_analyzer", "behavioral_analyzer", "llm_analyzer", "trigger_analyzer", "meta_analyzer" ], "timestamp": "2026-02-05T23:05:18.166407" }