ClawHub
Back to skill

Security audit

Ogp Expose

Security checks for vulnerabilities and agentic risk

Overview

This skill is a clear guide for intentionally exposing an OGP daemon through Cloudflare or ngrok, with the main public-access risks disclosed.

Use this only if you intentionally want your OGP daemon reachable from the internet. Verify the selected framework and port, confirm gatewayUrl matches the intended public endpoint, review any sudo or provider install commands, keep Cloudflare/ngrok credentials private, and enable launchd/systemd persistence only for a deliberate permanent deployment.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The usage section gives direct steps to expose a local daemon publicly before placing a prominent warning about privacy, attack surface, and unintended internet reachability. Because this skill operationalizes public exposure of a local service, insufficient upfront risk framing can lead users to expose services they do not fully understand, increasing the chance of accidental overexposure or misconfiguration.

Static analysis

No suspicious patterns detected.