ClawHub
Back to skill

Security audit

property-value

Security checks for vulnerabilities and agentic risk

Overview

This is a simple property valuation skill with sparse documentation and a missing referenced script, but the reviewed artifacts do not show hidden, destructive, persistent, or unrelated behavior.

Before installing, confirm where the missing property_value.py script comes from and review that code separately. Use a restricted API key, avoid sensitive input unless you understand the external service, and choose output paths carefully because the documented command writes a file.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
88% confidence
Finding
The skill's 'When to Use' guidance is vague and overly broad, which can cause an agent to invoke it in situations that are only loosely related to valuation. Over-broad routing increases the chance of unnecessary external API use, incorrect task selection, and unintended handling of user or business data in workflows that did not clearly require this skill.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The documentation instructs users to configure an API key but does not warn that the skill sends data to an external service or that credentials are required for that access. This can lead to uninformed use, accidental transmission of sensitive property-related data to third parties, and poor credential-handling practices in agent deployments.

Static analysis

No suspicious patterns detected.