ClawHub
Back to skill

Security audit

file-upload

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says: uploads user-provided media to Flyelep storage and returns a public permanent URL, with the main privacy risk disclosed in the instructions.

Install only if you are comfortable with selected local media becoming accessible through permanent public links. Do not upload confidential, private, or rights-unclear video/audio, and provide the Flyelep secretKey only at runtime rather than storing it in files or examples.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill uploads local media and returns permanent, publicly accessible direct links, but the front-matter description shown at selection time does not explicitly warn users about that exposure. This creates a real privacy and data-handling risk because users may provide sensitive local files expecting transient processing, while the skill causes durable public disclosure by design.

Static analysis

No suspicious patterns detected.