ClawHub
Back to skill

Security audit

Conference Poster Pitch

Security checks for vulnerabilities and agentic risk

Overview

This skill is a small local helper that prints conference poster pitch text and does not request credentials, network access, persistence, or broad file access.

Safe to install for simple poster-pitch drafting. Expect lightweight template output, not a full academic writing workflow; avoid passing sensitive unpublished details if you do not want them echoed in terminal or conversation logs.

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
This is a mismatch because the code's primary purpose is narrowly generating a poster-session elevator pitch from a title and selected duration, while the declared description presents it as a broader academic writing workflow aid emphasizing structured execution, explicit assumptions, and output boundaries. Those workflow-oriented behaviors are not implemented in the code. There is no hidden resource access or unrelated trigger behavior, but the stated purpose materially differs from the actual functionality.

Static analysis

No suspicious patterns detected.