ClawHub
Back to skill

Security audit

Hvac Operations

Security checks for vulnerabilities and agentic risk

Overview

This HVAC operations skill is a plain-text workflow guide with purpose-aligned customer scheduling and follow-up steps, but users should apply privacy and consent controls before using customer data.

Before installing, treat this as an operations template rather than a ready-made compliance policy. Limit technician briefings to the minimum needed for each job, avoid unnecessary sensitive notes, use approved business systems, confirm SMS/email consent and opt-out status, and ensure any CRM or review-management automation follows applicable privacy and marketing rules.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The dispatch process instructs sending technicians job history and customer notes, which may contain personal details, access instructions, billing context, or other sensitive information, without any guidance on least-privilege access or secure handling. In field-service operations this sharing can be necessary, but absent restrictions it increases the risk of overexposure, inappropriate disclosure, or insecure transmission of customer information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill prescribes automated email, SMS, phone follow-up, review solicitation, and CRM tracking using customer contact details and feedback, but provides no guardrails around consent, opt-out handling, data minimization, or privacy notice requirements. In an HVAC operations context this is operationally relevant data, but using it without clear privacy controls can lead to unauthorized marketing, mishandling of personal data, and regulatory noncompliance.

Content

No source excerpt is available for this finding.