ClawHub
Back to skill

Security audit

Ai Integration

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only AI integration skill with expected examples for LLM APIs, tools, memory, and RAG, but users should add privacy and access controls before using the examples in production.

Safe to install as reference material. Before copying the examples into production, restrict file/tool access, add loop limits and approval checks, avoid sending secrets or sensitive user data to model providers, review provider retention terms, and define clear memory storage and deletion rules.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill provides numerous examples that send arbitrary prompts, conversation history, files, and retrieved context to external LLM providers and also demonstrates persistent memory storage, but it does not warn users about privacy, retention, consent, or sensitive-data handling. In a production-oriented integration skill, this omission can lead developers to transmit secrets, personal data, or proprietary content to third-party APIs or store them locally without appropriate controls.

Static analysis

No suspicious patterns detected.