ClawHub
Back to skill

Security audit

smart-cart-command-planner

Security checks for vulnerabilities and agentic risk

Overview

This skill creates cautious smart-cart movement plans and includes a local validator, with no evidence of hidden network access, credential use, or direct hardware control.

Before installing, note that the skill may create a local plan JSON file while validating cart commands. Avoid putting sensitive location details in requests unless you are comfortable with them appearing in that temporary plan file, and treat generated plans as controller input that still needs real-world safety checks.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Low
Confidence
74% confidence
Finding
The skill instructs saving the generated plan JSON to disk and running a validator, but it does not disclose this side effect to the user or limit when persistence should occur. Silent disk writes can create privacy, integrity, or operational issues, especially if user requests contain sensitive route or environment details or if the write location is predictable/shared.

Static analysis

No suspicious patterns detected.