ClawHub
Back to skill

Security audit

Ai News Oracle

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a normal third-party search and summarization skill, with the main caveat that user queries and retrieved content are sent to SkillBoss for processing.

Install only if you are comfortable sending search prompts and retrieved content to SkillBoss. Avoid secrets, private customer data, regulated content, or internal documents unless your organization approves that external processing.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
83% confidence
Finding
The skill is explicitly designed to call a third-party API for search and summarization, but the documentation does not clearly warn users that prompts, search queries, and retrieved content will be transmitted off-platform to SkillBoss. In an agent setting, users may assume local processing, so this omission can lead to unintended disclosure of potentially sensitive prompts or derived data.

Static analysis

No suspicious patterns detected.