ClawHub
Back to skill

Security audit

Fashion Designer

Security checks for vulnerabilities and agentic risk

Overview

This fashion-advice skill is coherent with its purpose, but it can remember style profile details, browse shopping sites, and create or update Feishu documents.

Install only if you are comfortable with the agent storing fashion-profile details and feedback in USER.md, visiting configured shopping sites, and creating or updating Feishu documents. Review any helper skills it asks to install, and keep image downloads limited to expected product images.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Context-Inappropriate Capability

Medium
Confidence
84% confidence
Finding
The skill includes operational instructions to download arbitrary remote image URLs with curl into local temporary storage, which expands the skill from fashion advice into network/file handling. This can enable SSRF-style requests to attacker-controlled or internal URLs, unsafe content retrieval, and local disk exposure if image sources are not strictly validated.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill directs collection and persistent storage of personal profile attributes such as gender, age range, body type, and style preference in USER.md without notice or consent. Persistent retention of personal data creates privacy risk, unexpected profiling, and potential downstream misuse if the stored file is later accessed by other skills or operators.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill updates persistent preference records based on user feedback and modifies external documents without telling the user their preferences will be recorded over time. This creates covert behavioral profiling and retention risk, especially because preference history can reveal sensitive inferences about identity, body characteristics, or personal habits.

Static analysis

No suspicious patterns detected.