ClawHub
Back to skill

Security audit

summer Solstice countdown

Security checks for vulnerabilities and agentic risk

Overview

This skill is a simple time dashboard that uses disclosed public web APIs and does not show hidden access to files, credentials, or user data.

Install this only if you are comfortable with the generated widget contacting third-party public data APIs. Avoid it in environments where any external browser request is unacceptable; otherwise the behavior appears disclosed, narrow, and purpose-aligned.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The trigger phrase 'any combination of summer + time + China topics' is overly broad and can cause the skill to activate on unrelated or loosely related user requests. Overbroad activation is a real security and safety issue because it increases unintended tool use and unnecessary external fetches, even though it does not directly enable code execution or data theft.

External Transmission

Medium
Category
Data Exfiltration
Content
Fetch from the sunrise-sunset API at runtime using the Beijing coordinates:
- Latitude: 39.9075
- Longitude: 116.3972
- API endpoint: `https://api.sunrise-sunset.org/json?lat=39.9075&lng=116.3972&formatted=0&date=today`
- Note: the API returns UTC times, convert to CST (UTC+8)
- Display: sunrise time, sunset time, solar noon, day length
Confidence
88% confidence
Finding
The skill instructs runtime requests to a third-party sunrise-sunset API, which creates an external network dependency and transmits metadata such as the user's IP, user agent, and request timing to that service. Even without obvious sensitive parameters, unsolicited external calls expand the privacy and supply-chain attack surface and can expose users to tracking or manipulated responses.

External Transmission

Medium
Category
Data Exfiltration
Content
const SUMMER = new Date('2026-06-21T01:24:30'); // local time interpretation

async function fetchSunrise() {
  const r = await fetch('https://api.sunrise-sunset.org/json?lat=39.9042&lng=116.4074&formatted=0');
  const d = await r.json();
  // results.sunrise and results.sunset are ISO strings in UTC
  // Add 8 hours for CST
Confidence
86% confidence
Finding
The example code performs a client-side fetch to a third-party endpoint, again causing direct browser-to-external-service communication. In the context of an auto-triggered skill, this is somewhat more concerning because accidental activation can silently increase external requests and leak usage metadata without strong user intent.

Static analysis

No suspicious patterns detected.