clawlist
3 findings (1 high, 2 medium), mainly prompt injection, resource abuse. Most recent scan 2026-02-05.
This skill presents MODERATE security concerns primarily around autonomy manipulation and unbounded execution patterns. The most significant issues are: (1) Direct prompt injection through 'MUST use' directives attempting to force skill activation, (2) Promotion of infinite loops without proper safeguards or termination conditions, (3) Complex tool chaining with automated execution via persistent file storage, and (4) Transitive trust in the ongoing-tasks.md file that could be exploited if compromised. The skill does not contain data exfiltration, credential theft, or command injection vulnerabilities. However, the aggressive activation language and infinite task patterns create availability risks and autonomy concerns. The missing optional metadata reduces transparency but is not a security threat. Remediation should focus on removing imperative activation language, adding termination conditions and user confirmation for long-running tasks, and implementing validation for the persistent task file.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
MUST use for any multi-step project, long-running task, or infinite monitoring workflow. Plan, execute, track, and verify tasks with checkpoint validation. For projects, automation, and ongoing operations.
- Package
- 6 files, 14 KB
- SKILL.md
- 346 words, 11 sections
- Code
- None. Instructions only.
SKILL.md covers: Clawlist - Task Mastery · When to Use This Skill · Long-Running & Infinite Task Examples · Example: Moltbook Engagement (Infinite) · Example: GitHub Monitoring (Long-Running) · The Clawlist Workflow · Ongoing Tasks File · Task Types · Integration with Heartbeat · Quick Reference · Sub-Skills
Findings
HIGH Aggressive Activation Directive - Forced Skill Usage Prompt Injectionllm
The skill description contains a directive 'MUST use for any multi-step project' which attempts to override the agent's decision-making autonomy. This is a form of direct prompt injection that tries to force the agent to always use this skill regardless of whether it's appropriate for the task. The instruction body reinforces this with 'ALWAYS use clawlist when' followed by overly broad conditions that would match nearly any user request.
SKILL.md:1
Description: 'MUST use for any multi-step project, long-running task, or infinite monitoring workflow'
Instruction body: 'ALWAYS use clawlist when: Starting any new project or initiative, Setting up long-running monitoring, Breaking down complex goals'MEDIUM Unbounded Autonomy - Infinite Loop Encouragement Resource Abusellm
The skill explicitly promotes 'infinite monitoring workflow' and 'infinite tasks' with examples like 'Moltbook Engagement (Infinite)' running 'Every 30 minutes' forever. This creates availability risks through unbounded resource consumption and continuous execution without clear termination conditions. The integration with 'heartbeat' to 'Execute due infinite tasks' suggests automated, perpetual execution.
SKILL.md
'MUST use for any multi-step project, long-running task, or infinite monitoring workflow'
'Example: Moltbook Engagement (Infinite) - Type: Infinite loop - Schedule: Every 30 minutes'
'Heartbeat reads ongoing-tasks.md every check to: Execute due infinite tasks'MEDIUM Transitive Trust via Persistent Task File Prompt Injectionllm
The skill relies on a persistent file 'memory/tasks/ongoing-tasks.md' that is read and executed by the heartbeat system. This file becomes a trusted source of instructions that the agent will follow automatically. If this file is compromised or contains malicious instructions, the agent would execute them without question during heartbeat checks.
SKILL.md
'Location: memory/tasks/ongoing-tasks.md'
'Tracks all long-running and infinite tasks. Updated by heartbeat to: Check task health, Detect blockers, Execute due tasks'
'Heartbeat reads ongoing-tasks.md every check to: Execute due infinite tasks'What is in the package
| File | Kind | Size |
|---|---|---|
SKILL.md | doc | 2.7 KB |
brainstorming/SKILL.md | doc | 2.1 KB |
dispatch-multiple-agents/SKILL.md | doc | 1.8 KB |
doing-tasks/SKILL.md | doc | 3.3 KB |
verify-task/SKILL.md | doc | 2.3 KB |
write-plan/SKILL.md | doc | 2.0 KB |
Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://clawhub.ai/skills/clawlist
- Raw scan result: clawlist-scan.json
- Badge for your README:
- Request a re-scan