ClawHub
Back to skill

Security audit

kenkyu research

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward wrapper-style instruction for a paid external research API, with no hidden code or local system access.

Install this only if you want agents to send research queries to kenkyu.dev using your token and paid balance. Avoid using it for sensitive, regulated, or confidential material unless you are comfortable with that data being processed by the external research service.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The skill description is broad enough to trigger on many research-related prompts, which increases the chance the agent will invoke an external API unnecessarily. In this skill, that matters because invocation can transmit user queries and token-authenticated requests to a third-party service, expanding privacy and cost exposure beyond what the user may expect.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The markdown does not warn that user prompts, follow-up context, and a token are sent to an external service. Because this skill encourages broad research use and supports follow-up runs built on prior results, users may unknowingly disclose sensitive data to a third party or incur paid API usage without informed consent.

Static analysis

No suspicious patterns detected.