ClawHub
Back to skill

Security audit

page-filed-analyzer

Security checks for vulnerabilities and agentic risk

Overview

This instruction-only skill opens a user-provided webpage to count form fields, and its browser access is disclosed and aligned with that purpose.

Safe to install for analyzing form fields on webpages you choose. Use it on trusted URLs where possible, avoid localhost/internal or sensitive sites unless intended, and prefer a separate browser profile for pages requiring login.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill directs the agent to open arbitrary user-supplied URLs in a browser automation context without any warning, validation, or restriction. This can expose the agent environment to untrusted web content, trigger active page scripts, and enable phishing, tracking, or interaction with sensitive internal resources if network boundaries are not enforced.

Static analysis

No suspicious patterns detected.