ClawHub
Back to skill

Security audit

Report Generator

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed marketing report generator that saves report outputs and summary learnings in expected memory locations.

Before installing, be aware that generated reports and key campaign conclusions may be written to persistent memory. Use it with campaign, financial, CRM, or analytics data only when that data is appropriate for your agent workspace.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Low
Confidence
91% confidence
Finding
This markdown skill description explicitly states that it will save a finished report to `memory/influencer/report-generator/...` and write durable verdicts to `memory/hot-cache.md`. Although the behavior is documented as part of the contract, there is no warning to the user about persisting or overwriting data in memory, which is a user-data-affecting behavior for markdown files under the missing-warning rule.

Static analysis

No suspicious patterns detected.