ClawHub
Back to skill

Security audit

邮轮产品智能助手

Security checks for vulnerabilities and agentic risk

Overview

This is a simple cruise-product assistant that uses a disclosed external gateway, with no hidden code, persistence, or local data access found.

Install only if you are comfortable sending cruise search queries and related request content to the CruiseSkillBridge/olavacations external gateway. Avoid including secrets, payment data, or sensitive personal information unless you have reviewed that service's privacy and retention terms.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill instructs users to send POST requests to an external endpoint and explicitly notes that calls will be routed through a gateway and counted in console statistics, but it does not disclose that request contents may be transmitted to and retained by third-party infrastructure. This creates a privacy and data-handling risk because users may include sensitive customer, itinerary, or business data under the assumption that the interaction is local or minimally logged.

Static analysis

No suspicious patterns detected.