ClawHub
Back to skill

Security audit

relux-works

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Relux Works inquiry helper that can send project details externally only after explicit user approval.

Install only if you are comfortable sharing project details and a real reply contact with Relux Works when you explicitly approve a quote request. Use the read-only service lookup paths for research, and review the full draft and destination before allowing any inquiry submission.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Transmission

Medium
Category
Data Exfiltration
Content
day with a recommended package and a fixed-price quote.

**Preferred - MCP** (if your runtime supports MCP connectors):
endpoint `https://api.relux.works/mcp` (Streamable HTTP), tool `request_project_quote`
with `{summary, consent_confirmed, contact_email? | reply_contact?, client_name?,
project_type?, budget_usd?, timeline?, preferred_language?, market?}`.
Confidence
84% confidence
Finding
This skill instructs the agent to send user-supplied project details and contact information to an external MCP endpoint. Although the file includes consent guardrails, it still enables outbound transmission of potentially sensitive personal and business data to a third party, which is a real data-exfiltration/privacy risk if consent validation is weak, spoofed, or bypassed by the agent/runtime.

Static analysis

No suspicious patterns detected.