ClawHub
Back to skill

Security audit

Dfw Content Calendar

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent content-calendar generator, but users should understand it may use Anthropic's hosted API and some documented features/local-backend claims are overstated.

Install this if you are comfortable providing an Anthropic API key and sending the niche, audience, and generated-content prompts to Anthropic when the local backend is unavailable. Treat the local MLX and premium-feature claims cautiously because the implementation does not fully match the documentation; prefer sandboxed execution and pinned dependencies for production use.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:33
Finding

Unpinned Anthropic SDK Dependency Creates a Supply-Chain Risk

Content
View full analysis
Remediation
View remediation
``` 2. Maintain a lockfile containing exact transitive dependency versions. 3. Require cryptographic hashes for downloaded distributions where supported. 4. Restrict dependency retrieval to the official, trusted package registry. 5. Review and test dependency updates before changing the pinned version. 6. Run the Skill in a sandbox with minimal filesystem and network access. 7. Provide `ANTHROPIC_API_KEY` only when the remote backend is required, and avoid exposing unrelated credentials to the process. ]]>

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The line states 'Local MLX first (free, unlimited), Haiku fallback,' which describes a two-stage implementation strategy. However, elsewhere in the file the only declared runtime dependency is the Anthropics SDK and the only required environment variable is ANTHROPIC_API_KEY, with no MLX package, model, or setup instructions present, so the documentation contradicts the described code/integration reality.

Content

No source excerpt is available for this finding.

Internal Network Request

Medium
Category
Server-Side Request Forgery
Confidence
70% confidence
Finding

Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Content

Scanner excerpt · generate_calendar.py (reported line 171)May include surrounding context.

python
else:
        try:
            import openai, urllib.request
            urllib.request.urlopen("http://localhost:8800/health", timeout=1)
            return openai.OpenAI(base_url="http://localhost:8800/v1", api_key="local"), "local"
        except Exception:
            import anthropic

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

If the local health check fails, the script silently falls back to Anthropic and sends user-supplied niche/audience prompt data off-host. In an agent-skill context, users may reasonably expect local-only processing based on the tool description and environment variable examples, so this creates an unintended data egress/privacy issue rather than direct code execution.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The top-level description presents the tool as a content calendar generator, but line L007 states it falls back to Claude Haiku, and the implementation uses Anthropic's hosted API at L165-L175 and L185-L189. Because no manifest is available, this is only a mild description/behavior mismatch: the networked generation behavior is real, but partially disclosed in the module docstring rather than hidden.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.