ClawHub
Back to skill

Security audit

Creative Inspiration Hub

Security checks for vulnerabilities and agentic risk

Overview

This is a local creative brainstorming skill with no evidence of network access, credential use, persistence, or destructive behavior.

Installers should know this skill may activate for broad creative brainstorming prompts, so use it when you want structured ideation or evaluation. I found no artifact-backed evidence of network calls, credential handling, persistence, or destructive actions.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill claims it does not rely on external APIs, but the documentation exposes code execution-related capabilities through validation commands and example imports, while no explicit permissions are declared. This creates a transparency and governance gap: a host may treat the skill as low-risk even though it can read local files or invoke shell commands during testing or execution contexts.

Vague Triggers

Medium
Confidence
81% confidence
Finding
The trigger phrases are broad enough to match ordinary creative discussions, which can cause unintentional invocation in unrelated conversations. Over-broad activation increases the chance the skill intercepts prompts unexpectedly, potentially exposing user content to code-backed processing or producing outputs when the user did not intend to use this skill.

Vague Triggers

Medium
Confidence
79% confidence
Finding
The usage examples define activation around common, natural-language requests rather than clear boundaries, making the skill likely to trigger on routine brainstorming or product discussions. In a multi-skill environment, this can lead to misrouting, unintended data exposure to the skill, and execution of skill logic without informed user intent.

Static analysis

No suspicious patterns detected.