ClawHub
Back to skill

Security audit

Biztonsági és Egészségvédelmi Terv

Security checks for vulnerabilities and agentic risk

Overview

This is a Hungarian construction safety-plan helper with no executable code, network behavior, persistence, or hidden authority.

Reasonable to install for Hungarian BET document drafting. Treat completed intake forms as business-sensitive because they may include tax IDs, contact details, permits, and project documents, and review the generated BET with a qualified occupational safety professional.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The document solicits multiple personal and business identifiers, including contact names, phone numbers, email addresses, and tax information, but provides no guidance on lawful basis, minimization, storage, transmission security, or retention. In a document intended for partner data collection, this omission increases privacy and data-handling risk because recipients may send sensitive information through insecure channels or without clear consent and handling expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The natural-language content and command arguments are presented only in Hungarian, which can amount to forcing a specific language on users without opt-in. The file does not state that the skill is limited to Hungarian-speaking users or that the locale restriction is required by the hosting environment.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

All user-facing instructions and labels are presented only in Hungarian, which can constitute a language-policy issue when no opt-in, alternative language, or explicit regional justification is provided. The file does not state that it is intended exclusively for Hungarian-speaking users or a Hungary-specific workflow.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.