ClawHub
Back to skill

Security audit

Agent Task

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed task-management skill for AI agents that uses a third-party API and includes normal task, comment, attachment, and delete operations.

Install only if you are comfortable using the disclosed external task service for agent coordination. Avoid uploading sensitive attachments or confidential task details unless you trust the provider and have checked its privacy and retention terms, and require explicit confirmation before any delete action.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill exposes destructive delete capabilities for tasks, comments, and attachments but does not warn the user that these actions may permanently remove data and associated history. In an agent-executed workflow, lack of confirmation or irreversibility guidance increases the chance of accidental destructive actions and data loss, especially because the skill is designed for orchestration and automation.

Static analysis

No suspicious patterns detected.