ClawHub
Back to skill

Security audit

public-relations

Security checks for vulnerabilities and agentic risk

Overview

This skill is a public-relations guide whose journalist research and media-list behavior is disclosed and aligned with its purpose, though users should handle contact data carefully.

Install/use this as a PR workflow aid, not as a bulk scraping or spam tool. Keep journalist contact lists private, collect only professional information needed for outreach, respect 'no PR pitches' notices and opt-outs, and follow applicable privacy, anti-spam, and platform rules.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill explicitly directs users to collect journalists' email addresses from public sources but provides no guidance on lawful basis, minimization, consent expectations, or safe handling of personal data. In a PR workflow this is common business activity, but omission of privacy and retention safeguards can lead to misuse, overcollection, or noncompliant outreach practices.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill recommends browser-driven scraping of journalists' outlet pages and social profiles without any caution about platform terms, privacy expectations, rate limits, or responsible collection boundaries. Even when using normal browsing, turning profile data into a structured dossier can create privacy, compliance, and account-abuse risk if done at scale or without limits.

Missing User Warnings

Low
Confidence
90% confidence
Finding
The skill instructs maintaining a media list containing identifiable contact data and outreach history, but omits basic protections such as least-privilege access, secure storage, retention limits, and deletion/update practices. The context is operationally legitimate, yet an unsecured shared list can expose personal data and relationship intelligence if leaked or broadly accessible.

Static analysis

No suspicious patterns detected.