ClawHub
Back to skill

Security audit

attribution

Security checks for vulnerabilities and agentic risk

Overview

This skill gives attribution and tracking guidance with disclosed privacy-sensitive analytics patterns, but no hidden execution or unrelated access.

Before installing or applying the implementation guidance, confirm that your privacy notice, consent setup, vendor contracts, and retention rules cover sharing analytics identifiers and conversion metadata with third-party tools. Prefer the documented fail-closed safeguards, avoid sending emails or stable user IDs in URLs, and test webhook validation before production use.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill recommends propagating an anonymous distinct ID through third-party URLs and recovering it via webhooks, which creates a privacy and data-sharing risk if users are not explicitly warned about consent, disclosure, retention, and vendor exposure. Even though the text includes technical guardrails against sending obvious PII, identifiers in URLs can still be logged by intermediaries, stored by third parties, and treated as personal data under privacy regimes when linkable to a person after identity merge.

Static analysis

No suspicious patterns detected.