ClawHub
Back to skill

Security audit

Mnemonic Generator

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed local data-visualization workflow that reads phylogenetic input files and writes image outputs, with no evidence of hidden persistence, credential use, or network exfiltration.

Reasonable to install if you need this phylogenetic tree visualization workflow. Before running it, inspect the packaged script, use non-sensitive input files, keep input and output paths inside the workspace, and resolve the dependency ambiguity by installing only the documented Python packages you actually need.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The documentation explicitly states that Python/R scripts may execute locally and that the skill can read and write files, but it does not clearly warn users about the operational and security implications of those behaviors. In an agent skill context, this can mislead users into invoking a capability that affects the local environment, increasing the risk of unintended file modification, unsafe path handling, or execution of unreviewed code.

Static analysis

No suspicious patterns detected.