ClawHub
Back to skill

Security audit

Recipe Copy Sheet For New Month

Security checks for vulnerabilities and agentic risk

Overview

This is a simple Google Sheets recipe that clearly performs the intended tab-copying task, though users should verify IDs before running the write commands.

Before installing or using this recipe, confirm the target spreadsheet ID, template sheet ID, destination spreadsheet, and new tab name. Consider testing on a copy if the spreadsheet is used for important tracking, because the copy and rename steps will change live Google Sheets data.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill instructs the user or agent to perform live Google Sheets write operations, including copying a tab and renaming it, without any warning that these commands modify persistent spreadsheet data. In a productivity context this is a real safety issue because a mistaken spreadsheet ID, template sheet ID, or target tab ID could alter production tracking data or create confusing duplicate tabs without explicit user confirmation.

Content

No source excerpt is available for this finding.