ClawHub
Back to plugin

Security audit

Evidencecraft

Security checks for vulnerabilities and agentic risk

Overview

Evidencecraft is a coherent reporting-workflow skill bundle that reads and writes project report artifacts as disclosed, with no evidence of hidden exfiltration, destructive behavior, or unsafe automatic execution.

Install this only in workspaces where the agent is allowed to read analysis inputs and create report artifacts. Review the generated plans before execution on sensitive data, and treat final-save authority as local file publication within the project, not as external distribution.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (10)

Lp3

Medium
Category
MCP Least Privilege
Confidence
77% confidence
Finding
The skill operationally requires file-reading capabilities throughout the run lifecycle ('read the exact current Plan', inspect progress, verify outputs, and read referenced artifacts), but no permissions are explicitly declared. This creates a trust and containment gap: the skill may be granted or rely on undeclared filesystem access, making review and least-privilege enforcement harder.

Hidden Instructions

High
Category
Prompt Injection
Content
<!-- Template use: render every heading, label, table header, placeholder replacement, and narrative passage in the confirmed artifact language. The sample title's “Metric Definition” phrase is a translatable artifact-type label, not a canonical identifier. Preserve canonical codes and IDs, exact Skill names, paths, hashes, citations, code, formulas, and original source titles. Remove this and every Template instruction comment from the instantiated artifact. -->

# Metric Definition: [metric name]
Confidence
93% confidence
Finding
The HTML comment contains hidden operational instructions that can influence agent behavior while being invisible in normal rendered output. Hidden instructions are dangerous because they can override or subtly steer execution semantics without user visibility, reducing auditability and creating a channel for prompt injection or policy-conflicting behavior in downstream agent chains.

Hidden Instructions

High
Category
Prompt Injection
Content
<!-- Apply the shared language contract. Keep exact governance locators. Omit empty optional sections and remove this instruction. -->
# Work Package Result: [WP title]

**Status:** DONE | DONE_WITH_CONCERNS | NEEDS_CONTEXT | BLOCKED
Confidence
95% confidence
Finding
The HTML comment contains operative hidden instructions: apply a shared language contract, preserve governance locators, omit sections, and remove the instruction itself. Hidden instructions are dangerous because they influence model behavior without transparency, making it harder for reviewers and users to detect output shaping, policy steering, or suppression of context; the self-removal clause further reduces auditability.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The skill is presented as a review-only control, but it also authorizes itself to perform the post-review save/copy operation. That collapses separation of duties between independent review and release execution, increasing the risk that an approval step can directly publish bytes without an independent handoff or additional control.

Intent-Code Divergence

Medium
Confidence
89% confidence
Finding
The text says the skill should not own execution corrections or semantic redesign, but later instructions give it active operational authority to copy reviewed bytes to final destinations. This inconsistency can cause operators or agents to over-trust the skill's governance boundary while it still has release capability, undermining review independence and making misuse easier.

Vague Triggers

Low
Confidence
86% confidence
Finding
The default prompt uses a broad activation phrase, "$defining-metrics," without additional constraints on scope, inputs, or disambiguation criteria. This can cause the skill to be invoked in situations outside its intended domain, leading to incorrect metric-definition behavior, workflow confusion, or unintended prompt routing rather than direct security compromise.

Missing User Warnings

Low
Confidence
90% confidence
Finding
The skill explicitly instructs the agent to instantiate and persist a Markdown Analysis Brief in the workspace, but the skill metadata/description does not clearly disclose that it creates or modifies files. This can lead to unexpected workspace changes, accidental overwrites, or user surprise, especially in environments where file writes are sensitive and users rely on descriptions to understand side effects.

Natural-Language Policy Violations

Medium
Confidence
82% confidence
Finding
The template mandates a 'shared language contract' and exact governance formatting without any visible user opt-in or contextual disclosure. In an agent skill, this can silently steer outputs, constrain expression, or prioritize framework-specific governance requirements over the user's explicit instructions, which is a prompt-governance risk even if not overtly malicious.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The skill explicitly instructs the agent to read and apply a shared language/localization contract for questions and revised Source Profiles, without indicating that this behavior is optional or controlled by user preference. In an agent system, forcing output language or localization policy can override user intent, create prompt-routing conflicts, and potentially cause downstream artifacts to be generated in an unintended language or format.

Tp4

High
Category
MCP Tool Poisoning
Confidence
88% confidence
Finding
The description presents the skill as a workflow/state handler for Evidencecraft runs, but the behavior includes filesystem reads, hash computation, manifest parsing, and file identity verification. This mismatch can hide materially sensitive capabilities from reviewers and policy systems, increasing the chance the skill is approved or invoked in contexts where those capabilities were not expected.

Static analysis

No suspicious patterns detected.