ClawHub
Back to skill

Security audit

Bo Ren

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Jupyter notebook creation and editing skill that runs local Python helpers and writes notebook files as expected.

Install this if you want an agent to create and edit notebook files locally. Before using it on important work, confirm the notebook/image/output paths, keep backups of existing notebooks, and remember that image embedding copies local image contents into the notebook file.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
This section explicitly tells the agent to execute Python via the terminal and persist notebooks/files, while avoiding user involvement and without any user-facing warning or consent step for local file modification. In context, the skill is designed to create and edit notebooks, so file writes are expected, but the lack of transparency and confirmation makes unintended overwrites, path misuse, or silent workspace changes materially more likely.

Static analysis

No suspicious patterns detected.