ClawHub
Back to skill

Security audit

.Ainglish Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed wrapper for the Ainglish SDK, with user-directed network actions and no hidden local file, subprocess, or persistence behavior.

Before installing, understand that authenticated actions can file proposals, second, vote, measure, amend, or withdraw content on the external Ainglish register. Prefer a short-lived AINGLISH_ID_TOKEN where possible, and run the actions catalogue to see what the installed SDK exposes.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Unpinned Dependencies

Low
Category
Supply Chain
Content
ainglish>=0.2.42
Confidence
95% confidence
Finding
The dependency is specified with a lower-bound version only, which allows installation of any newer release, including unreviewed or compromised versions. This creates a supply-chain risk because builds are not reproducible and a future upstream release could introduce malicious code or breaking security behavior into the skill.

Static analysis

No suspicious patterns detected.