ClawHub
Back to skill

Security audit

Bigdeal Supplier Finder

Security checks for vulnerabilities and agentic risk

Overview

This skill is a bounded supplier-research workflow that uses public search and fetch only, with clear limits against logins, credential use, scraping at scale, storage, or procurement recommendations.

Install only if you want an agent to perform structured supplier discovery. For live reports, explicitly decide whether web search and public page fetches are allowed, and keep it out of logged-in platforms, paid databases, contact enrichment, bulk scraping, and final supplier trust or purchasing decisions.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The skill’s invocation description is extremely broad and can be triggered for many ordinary research, sourcing, or supplier-discovery tasks. Over-broad auto-selection increases the chance the agent uses this skill in contexts involving external search/fetch, expanding the attack surface and potentially causing unintended data exposure or policy-boundary mistakes.

Credential Access

High
Category
Privilege Escalation
Content
Do not:

- log in, handle cookies, read sessions, solve captcha, bypass access controls, use paid APIs, or access credentialed sources;
- run recursive crawling, bulk scraping, database storage, contact enrichment, or background monitoring;
- label suppliers as trustworthy, safe, recommended, best, verified, compliant, or purchase-ready;
- count search pages, query-only snippets, AI answers without public URLs, failed fetches, restricted pages, paywalls, login walls, captcha pages, or D-grade raw signals as actionable leads.
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Static analysis

No suspicious patterns detected.