ClawHub
Back to skill

Security audit

MoA Explainer

Security checks for vulnerabilities and agentic risk

Overview

This is a local Python generator for drug-mechanism explanations, with the main caution that its optional output file can overwrite a path the user provides.

Before installing, treat this as a local script that writes text output when you pass --output. Use project-local output paths, avoid pointing it at important existing files, and independently review any medical or scientific explanation for accuracy before sharing it.

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Description-Behavior Mismatch

Medium
Confidence
97% confidence
Finding
The tool accepts an arbitrary path via --output and writes generated content directly to that location without restriction or validation. In an agent setting, untrusted prompts or workflow inputs could cause files to be created or overwritten outside the intended workspace, enabling clobbering of user files, poisoning downstream scripts, or persistence in sensitive locations the process can access.

Static analysis

No suspicious patterns detected.