ClawHub
Back to skill

Security audit

HumanAI Convention

Security checks for vulnerabilities and agentic risk

Overview

This is a narrow instruction-only skill for submitting a chosen interview transcript to an external scoring API, with privacy as the main consideration.

Install only if you are comfortable sending selected transcript content to humanaiconvention.com. Get consent from any human participant, remove names and sensitive or regulated details, avoid proprietary content, and review the service's privacy and retention terms before submitting.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill explicitly instructs users to POST interview transcripts containing potentially sensitive personal content to a third-party remote API, but it does not provide any privacy notice, consent guidance, retention details, or data-handling warning. Because the transcript format is built around eliciting recent lived experiences and sensory details, the context increases the likelihood that users will submit personal or confidential information without understanding the disclosure risk.

External Transmission

Medium
Category
Data Exfiltration
Content
openclaw:
    requires:
      bins:
        - curl
    homepage: https://humanaiconvention.com/agent
    emoji: "∴"
---
Confidence
86% confidence
Finding
The skill depends on curl and directs data submission to an external domain, which creates a real external-transmission path for user-provided content. In this skill's context, that content is not trivial telemetry but structured interview transcripts likely to contain sensitive human disclosures, so the transmission surface is materially more dangerous than a generic outbound API call.

Static analysis

No suspicious patterns detected.