ClawHub
Back to skill

Security audit

Hail Communication

Security checks for vulnerabilities and agentic risk

Overview

This skill openly provides an API-based way for an agent to send email, SMS, and calls, with no hidden code or automatic execution found.

Install only if you want the agent to send real email, SMS, or voice calls through Hail. Confirm any account signup and terms acceptance yourself, keep HAIL_API_KEY secret, and only authorize sends where you have consent and a lawful basis to contact the recipient.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill instructs the agent to obtain an API key and store it for later use, but it does not include any guidance on secure secret handling, scoping, rotation, or avoiding disclosure in logs and transcripts. In an agent setting, credentials are especially at risk of being exposed through tool output, memory, or prompt/context leakage, which could let an attacker send email, SMS, or calls from the workspace.

Static analysis

No suspicious patterns detected.