Security audit
Security checks for vulnerabilities and agentic risk
This pandas helper stores a small local preference file, but that behavior is disclosed, scoped, and user-controllable.
Before installing, understand that this skill will keep a local preferences file at ~/pandas/memory.md and may reuse those preferences in later sessions. Do not put sensitive information in that file; you can inspect, edit, or delete the ~/pandas/ directory if you no longer want the stored context.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
**User control:**
- View stored preferences: `cat ~/pandas/memory.md`
- Clear all data: `rm -rf ~/pandas/`
## Related Skills
Install with `clawhub install <slug>` if user confirms:
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
**User control:**
- View stored preferences: `cat ~/pandas/memory.md`
- Clear all data: `rm -rf ~/pandas/`
## Related Skills
Install with `clawhub install <slug>` if user confirms:
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
**User control:**
- View stored preferences: `cat ~/pandas/memory.md`
- Clear all data: `rm -rf ~/pandas/`
## Related Skills
Install with `clawhub install <slug>` if user confirms:
The setup instructions introduce persistent local memory storage and repeated session-to-session reading of user data, but that capability is not reflected in the skill's stated DataFrame-focused purpose. This creates an unnecessary data-retention channel, reduces transparency for users, and expands the skill's access beyond what is needed for pandas assistance.
The skill is instructed to create, read, and continuously update a user profile file in the local home directory even though its advertised function is pandas guidance. That mismatch violates least privilege and can normalize unnecessary persistence of user information, which could expose preferences or other shared context data to unintended access or misuse.
No suspicious patterns detected.