ClawHub
Back to skill

Security audit

Fossil

Security checks for vulnerabilities and agentic risk

Overview

This skill is purpose-aligned failure memory, but it broadly encourages sending task and failure details to a hosted persistent memory service without enough privacy, retention, or scoping controls.

Review before installing. Use this only if you are comfortable sending summarized task and failure details to the hosted Fossil service. Avoid recording secrets, personal data, account identifiers, email contents, customer data, regulated information, or detailed file contents; prefer sanitized summaries or a private/self-hosted deployment for sensitive work.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The skill instructs agents to call `fossil_search` before a wide range of non-trivial actions, which can normalize sending task descriptions to an external service far more often than users may expect. In practice, this broad trigger condition increases the chance that sensitive operational context, user content, or workflow metadata is unnecessarily disclosed to the remote API.

Missing User Warnings

High
Confidence
97% confidence
Finding
The skill explicitly advertises a live, free community API with no API key, but does not warn that `fossil_search` and especially `fossil_record` may transmit failure descriptions, resolutions, and task context off-host. Because the examples encourage recording detailed situations like emails, contacts, and workflow failures, users may unknowingly upload sensitive or regulated information to a third-party endpoint.

Static analysis

No suspicious patterns detected.