ClawHub
Back to skill

Security audit

ous-upload

Security checks for vulnerabilities and agentic risk

Overview

This skill is a clearly disclosed workflow for uploading a user-specified local file to an OUS object-storage service.

Install only if you intend agents to upload local files to the supplied OUS service. Before invoking it, verify the file path, destination domain, and token are correct, and avoid using it on secrets, credentials, private user data, or unrelated files without explicit approval.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill is explicitly designed to read a local file, compute metadata, and upload the contents to remote OUS endpoints, but it does not require an explicit user-facing consent or warning before transmitting local data. This creates a real privacy and data-exfiltration risk if an agent invokes the skill on sensitive files without making the network transfer clear to the user.

Static analysis

No suspicious patterns detected.