ClawHub
Back to skill

Security audit

Agent Tests

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local agent-testing utility that stores test cases and results on disk, which is disclosed and fits its purpose, but users should avoid putting secrets in test prompts or expected outputs.

Install only if you are comfortable with a local test framework writing test definitions, expected outputs, and result history into memory/agent-tests or a directory you choose. Do not include API keys, passwords, private customer data, or other secrets in test prompts, expected outputs, assertions, or fixtures unless you are prepared to manage those files yourself.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill explicitly states that test definitions, prompts, outputs, actual results, and benchmark history are persistently stored on disk, but it does not warn users that these artifacts may contain sensitive data. In practice, agent prompts and outputs often include credentials, personal data, proprietary business content, or security-sensitive failure details, so silent persistence creates a real risk of unintended local data exposure and retention.

Static analysis

No suspicious patterns detected.