ClawHub
Back to skill

Security audit

Deep Digest

Security checks for vulnerabilities and agentic risk

Overview

The skill’s text-analysis purpose is legitimate, but it under-discloses that it prints the fully assembled prompt containing the user’s raw input.

Review before installing. Use this only with text you are allowed to process, and avoid secrets, credentials, regulated data, confidential conversations, or third-party private content. Expect submitted text to be echoed in the command output unless the skill is changed to redact or suppress raw prompts.

SkillSpector

Vulnerability Patterns
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Vague Triggers

Medium
Confidence
83% confidence
Finding
The skill advertises processing of 'any text input' without boundaries, exclusions, or guidance on sensitive content. In practice, this broad scope can encourage users to submit private conversations, notes, credentials, regulated data, or third-party content, increasing the chance of inappropriate handling or overcollection.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill is explicitly aimed at processing messages, notes, articles, and conversations, which commonly contain personal or confidential information, yet it provides no warning about sensitive data handling. This omission can lead users to expose private conversational content without informed consent or minimization, creating privacy and compliance risk.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
User-supplied text is embedded verbatim into the generated prompt and then printed to stdout as part of the workflow output. If the input contains secrets, private conversations, tokens, or proprietary data, the skill will echo that sensitive content into logs, terminals, pipelines, or downstream systems without warning or redaction.

Direct Prompt Extraction

High
Category
System Prompt Leakage
Content
{text}
```
"""
    return prompt


def build_evaluator_prompt(generator_output: str, original_text: str, mode: str = "full") -> str:
Confidence
90% confidence
Finding
The generator prompt directly embeds arbitrary user input and the program later exposes that prompt in its JSON output. This creates a prompt disclosure and data leakage issue: sensitive input becomes part of emitted artifacts, and any hidden prompt structure is fully revealed to callers, making prompt injection testing and downstream misuse easier.

Static analysis

No suspicious patterns detected.