ClawHub
Back to skill

Security audit

Arrow's Information Paradox

Security checks across malware telemetry and agentic risk

Overview

This is a static strategy-advice skill about protecting information during deals, with no executable behavior or hidden access.

Safe to install as a strategic framework, but users should treat its patent, NDA, escrow, and deal-structure guidance as business strategy rather than legal advice and involve counsel before relying on it in real transactions.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
- The reproducible core (the thing a competitor could copy) is scheduled for an *early*, low-commitment disclosure rung.
- An NDA is being treated as full protection, with no defense against independent reinvention or an enforcement plan.
- A "demo" or "trial" would require handing over real access, source, or the full method rather than demonstrating outcomes.
- The patent-vs-secret choice is being made by default or habit, without asking whether the advantage is reverse-engineerable and how long it will last.
- The buyer keeps asking to advance disclosure "to build the relationship" while making no reciprocal commitment — and the seller is tempted to comply.
- As a buyer: you are being asked to pay on the seller's word, with no intermediary certification, escrow, or verifiable proxy for what is withheld.
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.