ClawHub
Back to skill

Security audit

奢华邮轮体验推荐

Security checks for vulnerabilities and agentic risk

Overview

This is a remote cruise recommendation skill with some incomplete privacy documentation, but no evidence of hidden local access, destructive actions, or credential use.

Install only if you are comfortable with cruise search inputs being sent through the CruiseSkillBridge/olavacations gateway and counted in usage statistics. Avoid entering secrets, payment details, passport data, or sensitive personal information unless the publisher provides clearer privacy and retention terms.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The usage instructions direct users to send POST requests to an external endpoint and explicitly mention gateway tracking/statistics, but they do not warn that request contents may be transmitted, logged, or retained by third parties. In an MCP skill context, users may submit sensitive prompts or business data, so undisclosed transmission and analytics increase privacy and data-handling risk.

Static analysis

No suspicious patterns detected.