ClawHub
Back to skill

Security audit

Kep Guide

Security checks for vulnerabilities and agentic risk

Overview

This is a KEP reference guide with no executable code or hidden system access, but its integration examples should be treated as illustrative and handled carefully.

Safe to install as a reference guide. Do not paste real KEP passwords or API tokens into chat or hardcode them from the examples, and verify legal duties, provider endpoints, delivery-proof retention, and approval workflows with official sources before using the snippets in production.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The guide includes concrete API and SMTP examples for sending legally significant KEP messages, including placeholders for bearer tokens and passwords, but provides no security guidance on secret storage, transport validation, authorization controls, audit logging, or the legal consequences of automated sending. In this context, readers may copy the examples into production and handle sensitive credentials or send binding legal notices without adequate safeguards, increasing the risk of credential exposure, unauthorized transmission, and compliance failures.

Static analysis

No suspicious patterns detected.