ClawHub
Back to skill

Security audit

Agent Portability Checker

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward portability-audit skill that scans a user-chosen skill folder and only changes files when the user explicitly runs its fix mode.

Run the audit mode first, then use --fix only on skill directories you intend to modify. Review the resulting diff because fix mode performs direct text replacements and does not create backups.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill instructs the agent to run a local Python script with optional auto-fix behavior, which implies shell execution plus file reads/writes and environment variable access, yet it declares no permissions. This creates a trust and transparency gap: a platform or reviewer cannot accurately gate or sandbox the skill's capabilities, increasing the chance of unintended file modification or access when the skill is invoked.

Static analysis

No suspicious patterns detected.