ClawHub
Back to skill

Security audit

Supplier Risk Scorecard

Security checks for vulnerabilities and agentic risk

Overview

This skill provides a structured supplier risk scorecard workflow and does not include hidden code, persistence, credential access, or automatic data movement.

Installers should treat supplier financials, audits, sanctions checks, and employee-related materials as confidential. Share only authorized, business-relevant excerpts and redact unnecessary personal data, secrets, credentials, and regulated information before using the skill.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill explicitly invites users to share supplier documents, financial statements, audit findings, and potentially employee-related materials, but it does not warn users up front about handling sensitive or personal information safely. This increases the chance that users overshare confidential business data or personal employee data into the system, creating unnecessary privacy, confidentiality, and compliance exposure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.